theory Finalise_C

lemma finaliseCap_ccorres:
  "\<And>final.
   ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (finaliseCap_ret_C.remainder_C rv')
                   \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv'))
   ret__struct_finaliseCap_ret_C_'
   (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap)
          and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s))
   (UNIV \<inter> {s. ccap_relation cap (cap_' s)} \<inter> {s. final_' s = from_bool final}
                        \<inter> {s. exposed_' s = from_bool flag \<comment> \<open>dave has name wrong\<close>}) []
   (finaliseCap cap final flag) (Call finaliseCap_'proc)" apply (rule_tac F="capAligned cap" in Corres_UL_C.ccorres_req) apply (clarsimp simp: valid_capAligned) apply (case_tac "P :: bool" for P) apply (rule ccorres_guard_imp2, erule finaliseCap_True_cases_ccorres) apply simp apply (subgoal_tac "\<exists>acap. (0 <=s (-1 :: word8)) \<or> acap = capCap cap") prefer 2 apply simp apply (erule exE) apply (cinit lift: cap_' final_' exposed_' cong: call_ignore_cong) apply csymbr apply (simp del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply (clarsimp simp: cap_get_tag_isCap isCap_simps
                    cong: if_cong) apply (clarsimp simp: word_sle_def) apply (rule ccorres_if_lhs) apply (rule ccorres_fail) apply (simp add: liftM_def del: Collect_const) apply (rule ccorres_rhs_assoc)+ apply (rule ccorres_add_return2) apply (ccorres_rewrite) apply (ctac add: Arch_finaliseCap_ccorres) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def Collect_const_mem) apply wp apply (vcg exspec=Arch_finaliseCap_modifies) apply (simp add: cap_get_tag_isCap Collect_False
               del: Collect_const) apply csymbr apply (simp add: cap_get_tag_isCap Collect_False Collect_True
               del: Collect_const) apply (rule ccorres_if_lhs) apply (simp, rule ccorres_fail) apply (simp add: from_bool_0 Collect_True Collect_False
               del: Collect_const) apply csymbr apply (simp add: cap_get_tag_isCap Collect_False Collect_True
               del: Collect_const) apply (rule ccorres_if_lhs) apply (simp add: Let_def) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: cap_get_tag_isCap word_sle_def
                          return_def word_mod_less_divisor
                          less_imp_neq [OF word_mod_less_divisor]) apply (frule cap_get_tag_to_H, erule(1) cap_get_tag_isCap [THEN iffD2]) apply (clarsimp simp: isCap_simps capAligned_def ccap_relation_NullCap_iff
                          objBits_simps' word_bits_conv
                          signed_shift_guard_simpler_32) apply (rule conjI) apply (simp add: word_less_nat_alt) apply (rule conjI) apply (auto simp: word_less_nat_alt)[1] apply (simp add: ccap_relation_def cap_zombie_cap_lift) apply (simp add: cap_to_H_def isZombieTCB_C_def ZombieTCB_C_def) apply (simp add: less_mask_eq word_less_nat_alt less_imp_neq) apply (simp add: mod_mask_drop[where n=5] mask_def[where n=5]
                     less_imp_neq [OF word_mod_less_divisor]
                     less_imp_neq Let_def) apply (thin_tac "a = b" for a b)+ apply (subgoal_tac "P" for P) apply (subst add.commute, subst unatSuc, assumption)+ apply (intro impI, rule conjI) apply (rule word_eqI) apply (simp add: word_size word_ops_nth_size nth_w2p
                       less_Suc_eq_le is_aligned_nth) apply (safe, simp_all)[1] apply (simp add: shiftL_nat ccap_relation_NullCap_iff) apply (rule trans, rule unat_power_lower32[symmetric]) apply (simp add: word_bits_conv) apply (rule unat_cong, rule word_eqI) apply (simp add: word_size word_ops_nth_size nth_w2p
                      is_aligned_nth less_Suc_eq_le) apply (safe, simp_all)[1] apply (subst add.commute, subst eq_diff_eq[symmetric]) apply (clarsimp simp: minus_one_norm) apply (rule ccorres_if_lhs) apply (simp add: Let_def getThreadCSpaceRoot_def locateSlot_conv
                     Collect_True Collect_False
                del: Collect_const) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply csymbr apply csymbr apply (rule ccorres_Guard_Seq)+ apply csymbr apply (ctac(no_vcg) add: unbindNotification_ccorres) apply (ctac(no_vcg) add: suspend_ccorres[OF cteDeleteOne_ccorres]) apply (ctac(no_vcg) add: prepare_thread_delete_ccorres) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: word_sle_def return_def) apply (subgoal_tac "cap_get_tag capa = scast cap_thread_cap") apply (drule(1) cap_get_tag_to_H) apply (clarsimp simp: isCap_simps capAligned_def ccap_relation_NullCap_iff) apply (simp add: ccap_relation_def cap_zombie_cap_lift) apply (simp add: cap_to_H_def isZombieTCB_C_def ZombieTCB_C_def
                        mask_def) apply (simp add: cte_level_bits_def tcbCTableSlot_def
                        Kernel_C.tcbCTable_def tcbCNodeEntries_def
                        bit.conj_disj_distrib2
                        word_bw_assocs) apply (simp add: objBits_simps ctcb_ptr_to_tcb_ptr_def) apply (frule is_aligned_add_helper[where p="tcbptr - ctcb_offset" and d=ctcb_offset for tcbptr]) apply (simp add: ctcb_offset_defs objBits_defs) apply (simp add: mask_def irq_opt_relation_def objBits_defs) apply (simp add: cap_get_tag_isCap) apply wp+ apply (rule ccorres_if_lhs) apply (simp add: Let_def) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def ccap_relation_NullCap_iff) apply (simp add: isArchCap_T_isArchObjectCap[symmetric]
               del: Collect_const) apply (rule ccorres_if_lhs) apply (simp add: Collect_False Collect_True Let_def
                del: Collect_const) apply (rule_tac P="(capIRQ cap) \<le>  ARM.maxIRQ" in ccorres_gen_asm) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply (rule_tac xf'=irq_' in ccorres_abstract,ceqv) apply (rule_tac P="rv' = ucast (capIRQ cap)" in ccorres_gen_asm2) apply (ctac(no_vcg) add: deletingIRQHandler_ccorres) apply (rule ccorres_from_vcg_throws[where P=\<top> ]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply (frule cap_get_tag_to_H, erule(1) cap_get_tag_isCap [THEN iffD2]) apply (simp add: ccap_relation_NullCap_iff split: if_split) apply wp apply (rule ccorres_if_lhs) apply simp apply (rule ccorres_fail) apply (rule ccorres_add_return, rule ccorres_split_nothrow_novcg[where r'=dc and xf'=xfdc]) apply (rule ccorres_Cond_rhs) apply (simp add: ccorres_cond_iffs) apply (rule ccorres_return_Skip) apply (rule ccorres_Cond_rhs) apply (simp add: ccorres_cond_iffs) apply (rule ccorres_return_Skip) apply (rule ccorres_Cond_rhs) apply (rule ccorres_inst[where P=\<top> and P'=UNIV]) apply simp apply (rule ccorres_Cond_rhs) apply (simp add: ccorres_cond_iffs) apply (rule ccorres_return_Skip) apply (simp add: ccorres_cond_iffs) apply (rule ccorres_return_Skip) apply (rule ceqv_refl) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def ccap_relation_NullCap_iff
                           irq_opt_relation_def) apply wp apply (simp add: guard_is_UNIV_def) apply (clarsimp simp: cap_get_tag_isCap word_sle_def Collect_const_mem) apply (intro impI conjI) apply (clarsimp split: bool.splits) apply (clarsimp split: bool.splits) apply (clarsimp simp: valid_cap'_def isCap_simps) apply (clarsimp simp: isCap_simps capRange_def capAligned_def) apply (clarsimp simp: isCap_simps valid_cap'_def) apply (clarsimp simp: isCap_simps valid_cap'_def) apply (clarsimp simp: isCap_simps valid_cap'_def) apply (clarsimp simp: isCap_simps valid_cap'_def ) apply (clarsimp simp: tcb_ptr_to_ctcb_ptr_def ccap_relation_def isCap_simps
                            c_valid_cap_def cap_thread_cap_lift_def cap_to_H_def
                            ctcb_ptr_to_tcb_ptr_def Let_def
                      split: option.splits cap_CL.splits if_splits) apply clarsimp apply (frule cap_get_tag_to_H, erule(1) cap_get_tag_isCap [THEN iffD2]) apply (clarsimp simp: isCap_simps) apply (clarsimp simp: tcb_cnode_index_defs ptr_add_assertion_def) apply clarsimp apply (frule cap_get_tag_to_H, erule(1) cap_get_tag_isCap [THEN iffD2]) apply (frule(1) ccap_relation_IRQHandler_mask) apply (clarsimp simp: isCap_simps irqInvalid_def
                          valid_cap'_def ARM.maxIRQ_def
                          Kernel_C.maxIRQ_def) apply (rule irq_opt_relation_Some_ucast_left, simp) apply (clarsimp simp: isCap_simps irqInvalid_def
                          valid_cap'_def ARM.maxIRQ_def
                          Kernel_C.maxIRQ_def) apply fastforce apply clarsimp apply (frule cap_get_tag_to_H, erule(1) cap_get_tag_isCap [THEN iffD2]) apply (frule(1) ccap_relation_IRQHandler_mask) by (clarsimp simp add: mask_eq_ucast_eq)

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<And>final. ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool final\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool flag\<rbrace>) [] (global.finaliseCap cap final flag) (Call finaliseCap_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>final s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool final\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool flag\<rbrace>\<rbrakk> \<Longrightarrow> capAligned cap
 2. \<And>final. capAligned cap \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool final\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool flag\<rbrace>) [] (global.finaliseCap cap final flag) (Call finaliseCap_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>final. capAligned cap \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool final\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool flag\<rbrace>) [] (global.finaliseCap cap final flag) (Call finaliseCap_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>final. \<lbrakk>capAligned cap; ?P12 final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool final\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool flag\<rbrace>) [] (global.finaliseCap cap final flag) (Call finaliseCap_'proc)
 2. \<And>final. \<lbrakk>capAligned cap; \<not> ?P12 final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool final\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool flag\<rbrace>) [] (global.finaliseCap cap final flag) (Call finaliseCap_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>final s s'. \<lbrakk>capAligned cap; isEndpointCap cap \<or> isNotificationCap cap \<or> isReplyCap cap \<or> isDomainCap cap \<or> cap = capability.NullCap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool final\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool flag\<rbrace>\<rbrakk> \<Longrightarrow> invs' s \<and> s' \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool final\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool flag\<rbrace>
 2. \<And>final. \<lbrakk>capAligned cap; \<not> (isEndpointCap cap \<or> isNotificationCap cap \<or> isReplyCap cap \<or> isDomainCap cap \<or> cap = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool final\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool flag\<rbrace>) [] (global.finaliseCap cap final flag) (Call finaliseCap_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>final. \<lbrakk>capAligned cap; \<not> (isEndpointCap cap \<or> isNotificationCap cap \<or> isReplyCap cap \<or> isDomainCap cap \<or> cap = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool final\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool flag\<rbrace>) [] (global.finaliseCap cap final flag) (Call finaliseCap_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>final. \<lbrakk>capAligned cap; \<not> (isEndpointCap cap \<or> isNotificationCap cap \<or> isReplyCap cap \<or> isDomainCap cap \<or> cap = capability.NullCap); \<exists>acap. 0 \<le>s - 1 \<or> acap = capCap cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool final\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool flag\<rbrace>) [] (global.finaliseCap cap final flag) (Call finaliseCap_'proc)
 2. \<And>final. \<lbrakk>capAligned cap; \<not> (isEndpointCap cap \<or> isNotificationCap cap \<or> isReplyCap cap \<or> isDomainCap cap \<or> cap = capability.NullCap)\<rbrakk> \<Longrightarrow> \<exists>acap. 0 \<le>s - 1 \<or> acap = capCap cap proof (prove)
goal (2 subgoals):
 1. \<And>final. \<lbrakk>capAligned cap; \<not> (isEndpointCap cap \<or> isNotificationCap cap \<or> isReplyCap cap \<or> isDomainCap cap \<or> cap = capability.NullCap)\<rbrakk> \<Longrightarrow> \<exists>acap. 0 \<le>s - 1 \<or> acap = capCap cap
 2. \<And>final. \<lbrakk>capAligned cap; \<not> (isEndpointCap cap \<or> isNotificationCap cap \<or> isReplyCap cap \<or> isDomainCap cap \<or> cap = capability.NullCap); \<exists>acap. 0 \<le>s - 1 \<or> acap = capCap cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool final\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool flag\<rbrace>) [] (global.finaliseCap cap final flag) (Call finaliseCap_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>final. \<lbrakk>capAligned cap; \<not> (isEndpointCap cap \<or> isNotificationCap cap \<or> isReplyCap cap \<or> isDomainCap cap \<or> cap = capability.NullCap); \<exists>acap. 0 \<le>s - 1 \<or> acap = capCap cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool final\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool flag\<rbrace>) [] (global.finaliseCap cap final flag) (Call finaliseCap_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>final acap. \<lbrakk>capAligned cap; \<not> (isEndpointCap cap \<or> isNotificationCap cap \<or> isReplyCap cap \<or> isDomainCap cap \<or> cap = capability.NullCap); 0 \<le>s - 1 \<or> acap = capCap cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool final\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool flag\<rbrace>) [] (global.finaliseCap cap final flag) (Call finaliseCap_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>finala acap exposed final capa. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q6326 finala acap exposed final capa) (?Q'6326 finala acap exposed final capa) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL isArchCap_'proc(capa);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__struct_finaliseCap_ret_C :== CALL Arch_finaliseCap_'proc(capa,final);;
return_C ret__struct_finaliseCap_ret_C_'_update ret__struct_finaliseCap_ret_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF final \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF final \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF exposed \<noteq> 0 THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF final \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(1 << unat \<acute>ret__unsigned,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF final \<noteq> 0 THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc(\<acute>tcb);;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,1 << unat 5,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF final \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc(\<acute>irq);;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))))))
 2. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q6326 finala acap exposed final capa s \<and> s' \<in> ?Q'6326 finala acap exposed final capa proof (prove)
goal (2 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag capa))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q6326 finala acap exposed final capa) (?G'6335 finala acap exposed final capa ret__unsigned_long) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__struct_finaliseCap_ret_C :== CALL Arch_finaliseCap_'proc(capa,final);;
return_C ret__struct_finaliseCap_ret_C_'_update ret__struct_finaliseCap_ret_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF final \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF final \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF exposed \<noteq> 0 THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF final \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(1 << unat \<acute>ret__unsigned,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF final \<noteq> 0 THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc(\<acute>tcb);;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,1 << unat 5,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF final \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc(\<acute>irq);;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 2. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q6326 finala acap exposed final capa s \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'6335 finala acap exposed final capa v} proof (prove)
goal (2 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag capa))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q6326 finala acap (from_bool flag) (from_bool finala) capa) (?G'6335 finala acap (from_bool flag) (from_bool finala) capa (from_bool (isArchCap_tag (cap_get_tag capa)))) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isArchCap_tag (cap_get_tag capa) THEN
  \<acute>ret__struct_finaliseCap_ret_C :== CALL Arch_finaliseCap_'proc(capa,from_bool finala);;
return_C ret__struct_finaliseCap_ret_C_'_update ret__struct_finaliseCap_ret_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 2. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q6326 finala acap exposed final capa s \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'6335 finala acap exposed final capa v} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag capa)); isArchCap_tag (cap_get_tag capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q7874 finala acap (from_bool flag) (from_bool finala) capa) (?S7877 finala acap (from_bool flag) (from_bool finala) capa (from_bool (isArchCap_tag (cap_get_tag capa)))) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_finaliseCap_ret_C :== CALL Arch_finaliseCap_'proc(capa,from_bool finala);;
return_C ret__struct_finaliseCap_ret_C_'_update ret__struct_finaliseCap_ret_C_';;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag capa)); \<not> isArchCap_tag (cap_get_tag capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7873 finala acap (from_bool flag) (from_bool finala) capa) (?T7875 finala acap (from_bool flag) (from_bool finala) capa (from_bool (isArchCap_tag (cap_get_tag capa)))) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?Q7874 finala acap exposed final capa s) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?R7873 finala acap exposed final capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> ?S7877 finala acap exposed final capa v) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> ?T7875 finala acap exposed final capa v)}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap capa arch_cap. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); 0 \<le>s - 1 \<or> acap = arch_cap; ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q7874 finala acap (from_bool flag) (from_bool finala) capa) (?S7877 finala acap (from_bool flag) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (if flag then fail else Arch.finaliseCap arch_cap finala) (\<acute>ret__struct_finaliseCap_ret_C :== CALL Arch_finaliseCap_'proc(capa,from_bool finala);;
return_C ret__struct_finaliseCap_ret_C_'_update ret__struct_finaliseCap_ret_C_';;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)) SKIP;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)) SKIP;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(Cond (if flag then UNIV else {}) (Guard DontReach {} SKIP) SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  Cond (if finala then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag capa)); \<not> isArchCap_tag (cap_get_tag capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7873 finala acap (from_bool flag) (from_bool finala) capa) (?T7875 finala acap (from_bool flag) (from_bool finala) capa (from_bool (isArchCap_tag (cap_get_tag capa)))) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?Q7874 finala acap exposed final capa s) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?R7873 finala acap exposed final capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> ?S7877 finala acap exposed final capa v) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> ?T7875 finala acap exposed final capa v)}} proof (prove)
goal (3 subgoals):
 1. \<And>finala capa arch_cap. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q7874 finala arch_cap (from_bool flag) (from_bool finala) capa) (?S7877 finala arch_cap (from_bool flag) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (if flag then fail else Arch.finaliseCap arch_cap finala) (\<acute>ret__struct_finaliseCap_ret_C :== CALL Arch_finaliseCap_'proc(capa,from_bool finala);;
return_C ret__struct_finaliseCap_ret_C_'_update ret__struct_finaliseCap_ret_C_';;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)) SKIP;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)) SKIP;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(Cond (if flag then UNIV else {}) (Guard DontReach {} SKIP) SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  Cond (if finala then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag capa)); \<not> isArchCap_tag (cap_get_tag capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7873 finala acap (from_bool flag) (from_bool finala) capa) (?T7875 finala acap (from_bool flag) (from_bool finala) capa (from_bool (isArchCap_tag (cap_get_tag capa)))) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?Q7874 finala acap exposed final capa s) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?R7873 finala acap exposed final capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> ?S7877 finala acap exposed final capa v) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> ?T7875 finala acap exposed final capa v)}} proof (prove)
goal (4 subgoals):
 1. \<And>finala capa arch_cap. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap; flag\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q7935 finala arch_cap (from_bool flag) (from_bool finala) capa) (?S7937 finala arch_cap (from_bool flag) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] fail (\<acute>ret__struct_finaliseCap_ret_C :== CALL Arch_finaliseCap_'proc(capa,from_bool finala);;
return_C ret__struct_finaliseCap_ret_C_'_update ret__struct_finaliseCap_ret_C_';;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)) SKIP;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)) SKIP;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(Cond (if flag then UNIV else {}) (Guard DontReach {} SKIP) SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  Cond (if finala then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 2. \<And>finala capa arch_cap. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap; \<not> flag\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7934 finala arch_cap (from_bool flag) (from_bool finala) capa) (?T7936 finala arch_cap (from_bool flag) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (Arch.finaliseCap arch_cap finala) (\<acute>ret__struct_finaliseCap_ret_C :== CALL Arch_finaliseCap_'proc(capa,from_bool finala);;
return_C ret__struct_finaliseCap_ret_C_'_update ret__struct_finaliseCap_ret_C_';;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)) SKIP;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)) SKIP;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(Cond (if flag then UNIV else {}) (Guard DontReach {} SKIP) SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  Cond (if finala then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 3. \<And>finala acap exposed final capa ret__unsigned_long. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag capa)); \<not> isArchCap_tag (cap_get_tag capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7873 finala acap (from_bool flag) (from_bool finala) capa) (?T7875 finala acap (from_bool flag) (from_bool finala) capa (from_bool (isArchCap_tag (cap_get_tag capa)))) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 4. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> ?Q7935 finala acap exposed final capa s) \<and> (\<not> flag \<longrightarrow> ?R7934 finala acap exposed final capa s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?R7873 finala acap exposed final capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> ?S7937 finala acap exposed final capa v) \<and> (\<not> flag \<longrightarrow> s \<in> ?T7936 finala acap exposed final capa v)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> ?T7875 finala acap exposed final capa v)}} proof (prove)
goal (3 subgoals):
 1. \<And>finala capa arch_cap. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap; \<not> flag\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7934 finala arch_cap (from_bool flag) (from_bool finala) capa) (?T7936 finala arch_cap (from_bool flag) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (Arch.finaliseCap arch_cap finala) (\<acute>ret__struct_finaliseCap_ret_C :== CALL Arch_finaliseCap_'proc(capa,from_bool finala);;
return_C ret__struct_finaliseCap_ret_C_'_update ret__struct_finaliseCap_ret_C_';;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)) SKIP;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)) SKIP;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(Cond (if flag then UNIV else {}) (Guard DontReach {} SKIP) SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  Cond (if finala then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag capa)); \<not> isArchCap_tag (cap_get_tag capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7873 finala acap (from_bool flag) (from_bool finala) capa) (?T7875 finala acap (from_bool flag) (from_bool finala) capa (from_bool (isArchCap_tag (cap_get_tag capa)))) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> ?R7934 finala acap exposed final capa s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?R7873 finala acap exposed final capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> ?T7936 finala acap exposed final capa v)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> ?T7875 finala acap exposed final capa v)}} proof (prove)
goal (3 subgoals):
 1. \<And>finala capa arch_cap. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap; \<not> flag\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7934 finala arch_cap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T7936 finala arch_cap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (Arch.finaliseCap arch_cap finala) (\<acute>ret__struct_finaliseCap_ret_C :== CALL Arch_finaliseCap_'proc(capa,from_bool finala);;
return_C ret__struct_finaliseCap_ret_C_'_update ret__struct_finaliseCap_ret_C_';;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)) SKIP;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)) SKIP;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(Cond {} (Guard DontReach {} SKIP) SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  Cond (if finala then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag capa)); \<not> isArchCap_tag (cap_get_tag capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7873 finala acap (from_bool flag) (from_bool finala) capa) (?T7875 finala acap (from_bool flag) (from_bool finala) capa (from_bool (isArchCap_tag (cap_get_tag capa)))) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> ?R7934 finala acap exposed final capa s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?R7873 finala acap exposed final capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> ?T7936 finala acap exposed final capa v)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> ?T7875 finala acap exposed final capa v)}} proof (prove)
goal (3 subgoals):
 1. \<And>finala capa arch_cap. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap; \<not> flag\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7934 finala arch_cap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T7936 finala arch_cap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (Arch.finaliseCap arch_cap finala) (\<acute>ret__struct_finaliseCap_ret_C :== CALL Arch_finaliseCap_'proc(capa,from_bool finala);;
(return_C ret__struct_finaliseCap_ret_C_'_update ret__struct_finaliseCap_ret_C_';;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)) SKIP;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)) SKIP;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(Cond {} (Guard DontReach {} SKIP) SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  Cond (if finala then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag capa)); \<not> isArchCap_tag (cap_get_tag capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7873 finala acap (from_bool flag) (from_bool finala) capa) (?T7875 finala acap (from_bool flag) (from_bool finala) capa (from_bool (isArchCap_tag (cap_get_tag capa)))) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> ?R7934 finala acap exposed final capa s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?R7873 finala acap exposed final capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> ?T7936 finala acap exposed final capa v)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> ?T7875 finala acap exposed final capa v)}} proof (prove)
goal (3 subgoals):
 1. \<And>finala capa arch_cap. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap; \<not> flag\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7934 finala arch_cap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T7936 finala arch_cap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (Arch.finaliseCap arch_cap finala >>= return) (\<acute>ret__struct_finaliseCap_ret_C :== CALL Arch_finaliseCap_'proc(capa,from_bool finala);;
(return_C ret__struct_finaliseCap_ret_C_'_update ret__struct_finaliseCap_ret_C_';;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)) SKIP;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)) SKIP;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(Cond {} (Guard DontReach {} SKIP) SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  Cond (if finala then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  Cond (if finala then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag capa)); \<not> isArchCap_tag (cap_get_tag capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7873 finala acap (from_bool flag) (from_bool finala) capa) (?T7875 finala acap (from_bool flag) (from_bool finala) capa (from_bool (isArchCap_tag (cap_get_tag capa)))) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> ?R7934 finala acap exposed final capa s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?R7873 finala acap exposed final capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> ?T7936 finala acap exposed final capa v)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> ?T7875 finala acap exposed final capa v)}} proof (prove)
goal (3 subgoals):
 1. \<And>finala capa arch_cap. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap; \<not> flag\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7934 finala arch_cap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T7936 finala arch_cap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (Arch.finaliseCap arch_cap finala >>= return) (\<acute>ret__struct_finaliseCap_ret_C :== CALL Arch_finaliseCap_'proc(capa,from_bool finala);;
return_C ret__struct_finaliseCap_ret_C_'_update ret__struct_finaliseCap_ret_C_')
 2. \<And>finala acap exposed final capa ret__unsigned_long. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag capa)); \<not> isArchCap_tag (cap_get_tag capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7873 finala acap (from_bool flag) (from_bool finala) capa) (?T7875 finala acap (from_bool flag) (from_bool finala) capa (from_bool (isArchCap_tag (cap_get_tag capa)))) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> ?R7934 finala acap exposed final capa s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?R7873 finala acap exposed final capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> ?T7936 finala acap exposed final capa v)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> ?T7875 finala acap exposed final capa v)}} proof (prove)
goal (5 subgoals):
 1. \<And>finala capa arch_cap rv ret__struct_finaliseCap_ret_C. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap; \<not> flag; ccap_relation (fst rv) (remainder_C ret__struct_finaliseCap_ret_C) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C ret__struct_finaliseCap_ret_C)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q7990 finala capa arch_cap rv) (?Q'7990 finala capa arch_cap rv ret__struct_finaliseCap_ret_C) [SKIP] (return rv) (return_C ret__struct_finaliseCap_ret_C_'_update (\<lambda>s. ret__struct_finaliseCap_ret_C))
 2. \<And>finala capa arch_cap. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap; \<not> flag\<rbrakk> \<Longrightarrow> \<lbrace>?R7996 finala arch_cap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> Arch.finaliseCap arch_cap finala \<lbrace>?Q7990 finala capa arch_cap\<rbrace>
 3. \<And>finala capa arch_cap. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap; \<not> flag\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7991 finala arch_cap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret__struct_finaliseCap_ret_C :== CALL Arch_finaliseCap_'proc(capa,from_bool finala) {s. \<forall>rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' s)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' s)) \<longrightarrow> s \<in> ?Q'7990 finala capa arch_cap rv (ret__struct_finaliseCap_ret_C_' s)}
 4. \<And>finala acap exposed final capa ret__unsigned_long. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag capa)); \<not> isArchCap_tag (cap_get_tag capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7873 finala acap (from_bool flag) (from_bool finala) capa) (?T7875 finala acap (from_bool flag) (from_bool finala) capa (from_bool (isArchCap_tag (cap_get_tag capa)))) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 5. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and ?R7996 finala acap exposed final capa) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?R7873 finala acap exposed final capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> ?R'7991 finala acap exposed final capa v)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> ?T7875 finala acap exposed final capa v)}} proof (prove)
goal (5 subgoals):
 1. \<And>finala capa arch_cap rv ret__struct_finaliseCap_ret_C. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap; \<not> flag; ccap_relation (fst rv) (remainder_C ret__struct_finaliseCap_ret_C) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C ret__struct_finaliseCap_ret_C)\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__struct_finaliseCap_ret_C_'_update (\<lambda>s. ret__struct_finaliseCap_ret_C) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return rv \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' s)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' s))}
 2. \<And>finala capa arch_cap. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap; \<not> flag\<rbrakk> \<Longrightarrow> \<lbrace>?R7996 finala arch_cap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> Arch.finaliseCap arch_cap finala \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>finala capa arch_cap. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap; \<not> flag\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7991 finala arch_cap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret__struct_finaliseCap_ret_C :== CALL Arch_finaliseCap_'proc(capa,from_bool finala) {s. \<forall>rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' s)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' s)) \<longrightarrow> s \<in> UNIV}
 4. \<And>finala acap exposed final capa ret__unsigned_long. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag capa)); \<not> isArchCap_tag (cap_get_tag capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7873 finala acap (from_bool flag) (from_bool finala) capa) (?T7875 finala acap (from_bool flag) (from_bool finala) capa (from_bool (isArchCap_tag (cap_get_tag capa)))) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 5. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and ?R7996 finala acap exposed final capa) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?R7873 finala acap exposed final capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> ?R'7991 finala acap exposed final capa v)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> ?T7875 finala acap exposed final capa v)}} proof (prove)
goal (5 subgoals):
 1. \<And>finala capa arch_cap rv ret__struct_finaliseCap_ret_C \<sigma>. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap; \<not> flag; ccap_relation (fst rv) (remainder_C ret__struct_finaliseCap_ret_C) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C ret__struct_finaliseCap_ret_C)\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return rv \<sigma>). (\<sigma>', s\<lparr>ret__struct_finaliseCap_ret_C_' := ret__struct_finaliseCap_ret_C, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation (fst rv) (remainder_C ret__struct_finaliseCap_ret_C) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C ret__struct_finaliseCap_ret_C)}
 2. \<And>finala capa arch_cap. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap; \<not> flag\<rbrakk> \<Longrightarrow> \<lbrace>?R7996 finala arch_cap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> Arch.finaliseCap arch_cap finala \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>finala capa arch_cap. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap; \<not> flag\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7991 finala arch_cap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret__struct_finaliseCap_ret_C :== CALL Arch_finaliseCap_'proc(capa,from_bool finala) {s. \<forall>rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' s)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' s)) \<longrightarrow> s \<in> UNIV}
 4. \<And>finala acap exposed final capa ret__unsigned_long. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag capa)); \<not> isArchCap_tag (cap_get_tag capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7873 finala acap (from_bool flag) (from_bool finala) capa) (?T7875 finala acap (from_bool flag) (from_bool finala) capa (from_bool (isArchCap_tag (cap_get_tag capa)))) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 5. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and ?R7996 finala acap exposed final capa) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?R7873 finala acap exposed final capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> ?R'7991 finala acap exposed final capa v)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> ?T7875 finala acap exposed final capa v)}} proof (prove)
goal (4 subgoals):
 1. \<And>finala capa arch_cap. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap; \<not> flag\<rbrakk> \<Longrightarrow> \<lbrace>?R7996 finala arch_cap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> Arch.finaliseCap arch_cap finala \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>finala capa arch_cap. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap; \<not> flag\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7991 finala arch_cap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret__struct_finaliseCap_ret_C :== CALL Arch_finaliseCap_'proc(capa,from_bool finala) {s. \<forall>rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' s)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' s)) \<longrightarrow> s \<in> UNIV}
 3. \<And>finala acap exposed final capa ret__unsigned_long. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag capa)); \<not> isArchCap_tag (cap_get_tag capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7873 finala acap (from_bool flag) (from_bool finala) capa) (?T7875 finala acap (from_bool flag) (from_bool finala) capa (from_bool (isArchCap_tag (cap_get_tag capa)))) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 4. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and ?R7996 finala acap exposed final capa) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?R7873 finala acap exposed final capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> ?R'7991 finala acap exposed final capa v)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> ?T7875 finala acap exposed final capa v)}} proof (prove)
goal (3 subgoals):
 1. \<And>finala capa arch_cap. \<lbrakk>capAligned (capability.ArchObjectCap arch_cap); ccap_relation (capability.ArchObjectCap arch_cap) capa; cap = capability.ArchObjectCap arch_cap; \<not> flag\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7991 finala arch_cap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret__struct_finaliseCap_ret_C :== CALL Arch_finaliseCap_'proc(capa,from_bool finala) {s. \<forall>rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' s)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' s)) \<longrightarrow> s \<in> UNIV}
 2. \<And>finala acap exposed final capa ret__unsigned_long. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag capa)); \<not> isArchCap_tag (cap_get_tag capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7873 finala acap (from_bool flag) (from_bool finala) capa) (?T7875 finala acap (from_bool flag) (from_bool finala) capa (from_bool (isArchCap_tag (cap_get_tag capa)))) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?R7873 finala acap exposed final capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> ?R'7991 finala acap exposed final capa v)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> ?T7875 finala acap exposed final capa v)}} proof (prove)
goal (2 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag capa)); \<not> isArchCap_tag (cap_get_tag capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7873 finala acap (from_bool flag) (from_bool finala) capa) (?T7875 finala acap (from_bool flag) (from_bool finala) capa (from_bool (isArchCap_tag (cap_get_tag capa)))) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 2. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?R7873 finala acap exposed final capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> ?T7875 finala acap exposed final capa v)}} proof (prove)
goal (2 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7873 finala acap (from_bool flag) (from_bool finala) capa) (?T7875 finala acap (from_bool flag) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false)) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))))
 2. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?R7873 finala acap exposed final capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> ?T7875 finala acap exposed final capa v)}} proof (prove)
goal (2 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7873 finala acap (from_bool flag) (from_bool finala) capa) (?G'8106 finala acap (from_bool flag) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) ret__unsigned) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(capa);;
CALL cancelAllIPC_'proc(ep_Ptr \<acute>ret__unsigned)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
\<acute>ntfn :== ntfn_Ptr \<acute>ret__unsigned;;
CALL unbindMaybeNotification_'proc(\<acute>ntfn);;
CALL cancelAllSignals_'proc(\<acute>ntfn)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI;;
(IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))
 2. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?R7873 finala acap exposed final capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'8106 finala acap exposed final capa v va})}} proof (prove)
goal (2 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R7873 finala acap (from_bool flag) (from_bool finala) capa) (?G'8106 finala acap (from_bool flag) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa)) [SKIP] (if flag then haskell_fail [] else if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))
 2. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> ?R7873 finala acap exposed final capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'8106 finala acap exposed final capa v va})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag capa; flag\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q8737 finala acap (from_bool flag) (from_bool finala) capa) (?S8740 finala acap (from_bool flag) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa)) [SKIP] (haskell_fail []) (IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag capa; \<not> flag\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R8736 finala acap (from_bool flag) (from_bool finala) capa) (?T8738 finala acap (from_bool flag) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa)) [SKIP] (if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> ?Q8737 finala acap exposed final capa s) \<and> (\<not> flag \<longrightarrow> ?R8736 finala acap exposed final capa s))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> ?S8740 finala acap exposed final capa v va) \<and> (\<not> flag \<longrightarrow> s \<in> ?T8738 finala acap exposed final capa v va)}})}} proof (prove)
goal (2 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag capa; \<not> flag\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R8736 finala acap (from_bool flag) (from_bool finala) capa) (?T8738 finala acap (from_bool flag) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa)) [SKIP] (if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF flag THEN
  Guard DontReach {} SKIP
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))
 2. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> ?R8736 finala acap exposed final capa s))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> ?T8738 finala acap exposed final capa v va)}})}} proof (prove)
goal (2 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag capa; \<not> flag\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R8736 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T8738 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa)) [SKIP] (if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> ?R8736 finala acap exposed final capa s))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> ?T8738 finala acap exposed final capa v va)}})}} proof (prove)
goal (2 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R8736 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?G'8766 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) ret__unsigned) [SKIP] (if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> ?R8736 finala acap exposed final capa s))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> ?G'8766 finala acap exposed final capa v va vb})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R8736 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?G'8766 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isCNodeCap cap \<and> finala then let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap) else if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> ?R8736 finala acap exposed final capa s))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> ?G'8766 finala acap exposed final capa v va vb})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<and> finala\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q9463 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?S9466 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (let ptr = capCNodePtr cap; bits = capCNodeBits cap in return (capability.Zombie ptr (ZombieCNode bits) (HaskellLib_H.bit bits), capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> ?Q9463 finala acap exposed final capa s) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> ?S9466 finala acap exposed final capa v va vb) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<and> finala\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q9463 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa) (?S9466 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (return (capability.Zombie (capCNodePtr cap) (ZombieCNode (capCNodeBits cap)) (shiftL (Suc 0) (capCNodeBits cap)), capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> ?Q9463 finala acap exposed final capa s) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> ?S9466 finala acap exposed final capa v va vb) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.Zombie (capCNodePtr cap) (ZombieCNode (capCNodeBits cap)) (shiftL (Suc 0) (capCNodeBits cap)), capability.NullCap) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' s)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' s))}
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned \<sigma>. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<and> finala\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> (\<forall>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift capa) \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> (\<forall>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift capa) \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> (\<forall>t. ret__unsigned_' t = capCNodePtr_CL (cap_cnode_cap_lift capa) \<longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift capa) < 0x20 \<and> (capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 \<or> capCNodeRadix_CL (cap_cnode_cap_lift capa) < 0x1F) \<and> (\<forall>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 1 << 5 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 1 << 5 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa) && mask 6\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (\<forall>ta. cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return (capability.Zombie (capCNodePtr cap) (ZombieCNode (capCNodeBits cap)) (shiftL (Suc 0) (capCNodeBits cap)), capability.NullCap) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := capCNodeRadix_CL (cap_cnode_cap_lift capa), unsigned_eret_2_' := capCNodeRadix_CL (cap_cnode_cap_lift capa), unsigned_eret_3_' := capCNodePtr_CL (cap_cnode_cap_lift capa), ret__struct_cap_C_' := ret__struct_cap_C_' ta, fc_ret_' := finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' ta) (remainder_C_update (\<lambda>_. ret__struct_cap_C_' t) (fc_ret_' s)), ret__struct_finaliseCap_ret_C_' := finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' ta) (remainder_C_update (\<lambda>_. ret__struct_cap_C_' t) (fc_ret_' s)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation (fst rv) (remainder_C (finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' ta) (remainder_C_update (\<lambda>_. ret__struct_cap_C_' t) (fc_ret_' s)))) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' ta) (remainder_C_update (\<lambda>_. ret__struct_cap_C_' t) (fc_ret_' s))))))))))}
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>capAligned cap; ccap_relation cap capa; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; (\<sigma>, x) \<in> rf_sr; \<not> isEndpointCap cap; isCNodeCap cap; finala; \<not> isNotificationCap cap; \<not> isReplyCap cap; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift capa); ret__unsigned_' ta = capCNodePtr_CL (cap_cnode_cap_lift capa)\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift capa) < 0x20 \<and> (capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 \<or> capCNodeRadix_CL (cap_cnode_cap_lift capa) < 0x1F) \<and> (\<forall>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa) && mask 6\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (\<forall>ta. cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> ccap_relation (capability.Zombie (capCNodePtr cap) (ZombieCNode (capCNodeBits cap)) (shiftL (Suc 0) (capCNodeBits cap))) (ret__struct_cap_C_' t) \<and> ccap_relation capability.NullCap (ret__struct_cap_C_' ta)))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>capAligned cap; ccap_relation cap capa; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; (\<sigma>, x) \<in> rf_sr; \<not> isEndpointCap cap; isCNodeCap cap; finala; \<not> isNotificationCap cap; \<not> isReplyCap cap; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift capa); ret__unsigned_' ta = capCNodePtr_CL (cap_cnode_cap_lift capa); cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift capa) < 0x20 \<and> (capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 \<or> capCNodeRadix_CL (cap_cnode_cap_lift capa) < 0x1F) \<and> (\<forall>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa) && mask 6\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (\<forall>ta. cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> ccap_relation (capability.Zombie (capCNodePtr cap) (ZombieCNode (capCNodeBits cap)) (shiftL (Suc 0) (capCNodeBits cap))) (ret__struct_cap_C_' t) \<and> ccap_relation capability.NullCap (ret__struct_cap_C_' ta)))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>ccap_relation (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift capa); ret__unsigned_' ta = capCNodePtr_CL (cap_cnode_cap_lift capa); cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa))); is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift capa) < 0x20 \<and> (capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 \<or> capCNodeRadix_CL (cap_cnode_cap_lift capa) < 0x1F) \<and> (\<forall>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa) && mask 6\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> ccap_relation (capability.Zombie (capCNodePtr_CL (cap_cnode_cap_lift capa)) (ZombieCNode (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) (shiftL (Suc 0) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))))) (ret__struct_cap_C_' t))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>ccap_relation (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift capa); ret__unsigned_' ta = capCNodePtr_CL (cap_cnode_cap_lift capa); cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa))); is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift capa) < 0x20
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>ccap_relation (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift capa); ret__unsigned_' ta = capCNodePtr_CL (cap_cnode_cap_lift capa); cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa))); is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> (capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 \<or> capCNodeRadix_CL (cap_cnode_cap_lift capa) < 0x1F) \<and> (\<forall>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa) && mask 6\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> ccap_relation (capability.Zombie (capCNodePtr_CL (cap_cnode_cap_lift capa)) (ZombieCNode (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) (shiftL (Suc 0) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))))) (ret__struct_cap_C_' t))
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>ccap_relation (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift capa); ret__unsigned_' ta = capCNodePtr_CL (cap_cnode_cap_lift capa); cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa))); is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> (capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 \<or> capCNodeRadix_CL (cap_cnode_cap_lift capa) < 0x1F) \<and> (\<forall>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa) && mask 6\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> ccap_relation (capability.Zombie (capCNodePtr_CL (cap_cnode_cap_lift capa)) (ZombieCNode (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) (shiftL (Suc 0) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))))) (ret__struct_cap_C_' t))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>ccap_relation (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift capa); ret__unsigned_' ta = capCNodePtr_CL (cap_cnode_cap_lift capa); cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa))); is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 \<or> capCNodeRadix_CL (cap_cnode_cap_lift capa) < 0x1F
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>ccap_relation (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift capa); ret__unsigned_' ta = capCNodePtr_CL (cap_cnode_cap_lift capa); cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa))); is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> \<forall>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa) && mask 6\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> ccap_relation (capability.Zombie (capCNodePtr_CL (cap_cnode_cap_lift capa)) (ZombieCNode (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) (shiftL (Suc 0) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))))) (ret__struct_cap_C_' t)
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>ccap_relation (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift capa); ret__unsigned_' ta = capCNodePtr_CL (cap_cnode_cap_lift capa); cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa))); is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> \<forall>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa) && mask 6\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> ccap_relation (capability.Zombie (capCNodePtr_CL (cap_cnode_cap_lift capa)) (ZombieCNode (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) (shiftL (Suc 0) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))))) (ret__struct_cap_C_' t)
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift capa); ret__unsigned_' ta = capCNodePtr_CL (cap_cnode_cap_lift capa); cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa))); is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> (\<exists>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa) && mask 6\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap (cap_zombie_cap_lift (ret__struct_cap_C_' t)))) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> capability.Zombie (capCNodePtr_CL (cap_cnode_cap_lift capa)) (ZombieCNode (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) (shiftL (Suc 0) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) = cap_to_H (Cap_zombie_cap \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa) && mask 6\<rparr>)
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift capa); ret__unsigned_' ta = capCNodePtr_CL (cap_cnode_cap_lift capa); cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa))); is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> (\<exists>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa) && mask 6\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap (cap_zombie_cap_lift (ret__struct_cap_C_' t)))) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> capability.Zombie (capCNodePtr_CL (cap_cnode_cap_lift capa)) (ZombieCNode (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) (shiftL (Suc 0) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) = (if capCNodeRadix_CL (cap_cnode_cap_lift capa) && mask 6 = 0x20 then capability.Zombie (capZombieID_CL \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa) && mask 6\<rparr> && ~~ mask 5) ZombieTCB (unat (capZombieID_CL \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa) && mask 6\<rparr> && mask 5)) else let radix = unat (capZombieType_CL \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa) && mask 6\<rparr>) in capability.Zombie (capZombieID_CL \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa) && mask 6\<rparr> && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (if capCNodeRadix_CL (cap_cnode_cap_lift capa) = 0x20 then 5 else unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa) && mask 6\<rparr> && mask (radix + 1))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift capa); ret__unsigned_' ta = capCNodePtr_CL (cap_cnode_cap_lift capa); cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa))); is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> (\<exists>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa)\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap (cap_zombie_cap_lift (ret__struct_cap_C_' t)))) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> capability.Zombie (capCNodePtr_CL (cap_cnode_cap_lift capa)) (ZombieCNode (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) (shiftL (Suc 0) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) = (let radix = unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) in capability.Zombie ((capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ radix && mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1))) && ~~ mask (Suc radix)) (ZombieCNode radix) (unat ((capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ radix && mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1))) && mask (Suc radix))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift capa); ret__unsigned_' ta = capCNodePtr_CL (cap_cnode_cap_lift capa); cap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa))); is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> (\<exists>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa)\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap (cap_zombie_cap_lift (ret__struct_cap_C_' t)))) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift capa) = (capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1))) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) \<and> shiftL (Suc 0) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) = unat ((capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1))) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> (\<exists>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa)\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap (cap_zombie_cap_lift (ret__struct_cap_C_' t)))) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift capa) = (capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1))) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) \<and> shiftL (Suc 0) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) = unat ((capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1))) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28; ?P9657 finala capa \<sigma> x t ta\<rbrakk> \<Longrightarrow> (\<exists>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa)\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap (cap_zombie_cap_lift (ret__struct_cap_C_' t)))) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift capa) = (capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1))) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) \<and> shiftL (Suc 0) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) = unat ((capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1)) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa) + 1))) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))))
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> ?P9657 finala capa \<sigma> x t ta
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28; 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0\<rbrakk> \<Longrightarrow> (\<exists>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa)\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap (cap_zombie_cap_lift (ret__struct_cap_C_' t)))) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift capa) = (capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))))) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) \<and> shiftL (Suc 0) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) = unat ((capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))))) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))))
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (5 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28; 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0; \<exists>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa)\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap (cap_zombie_cap_lift (ret__struct_cap_C_' t))); \<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift capa) = (capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))))) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))))
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28; 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0; \<exists>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa)\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap (cap_zombie_cap_lift (ret__struct_cap_C_' t))); \<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> shiftL (Suc 0) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) = unat ((capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))))) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))))
 3. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (5 subgoals):
 1. \<And>finala capa \<sigma> x t ta n. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28; 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0; \<exists>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa)\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap (cap_zombie_cap_lift (ret__struct_cap_C_' t))); \<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> n < size (capCNodePtr_CL (cap_cnode_cap_lift capa)) \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift capa) !! n = ((capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))))) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))))) !! n
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28; 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0; \<exists>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa)\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap (cap_zombie_cap_lift (ret__struct_cap_C_' t))); \<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> shiftL (Suc 0) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) = unat ((capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))))) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))))
 3. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (5 subgoals):
 1. \<And>finala capa \<sigma> x n. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; \<forall>n<4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)). \<not> capCNodePtr_CL (cap_cnode_cap_lift capa) !! n; unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28; 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0; \<exists>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa)\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap (cap_zombie_cap_lift (ret__struct_cap_C_' t))); \<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> n < 32 \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift capa) !! n = ((capCNodePtr_CL (cap_cnode_cap_lift capa) !! n \<or> unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) = n \<and> n \<le> unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) \<and> \<not> n \<le> unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28; 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0; \<exists>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa)\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap (cap_zombie_cap_lift (ret__struct_cap_C_' t))); \<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> shiftL (Suc 0) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) = unat ((capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))))) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))))
 3. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28; 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0; \<exists>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa)\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap (cap_zombie_cap_lift (ret__struct_cap_C_' t))); \<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> shiftL (Suc 0) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) = unat ((capCNodePtr_CL (cap_cnode_cap_lift capa) && ~~ mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))))) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))))
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>finala capa \<sigma> x. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28; 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0; \<exists>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa)\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap (cap_zombie_cap_lift (ret__struct_cap_C_' t))); \<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) = unat ((capCNodePtr_CL (cap_cnode_cap_lift capa) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))))) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))))
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (5 subgoals):
 1. \<And>finala capa \<sigma> x. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28; 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0; \<exists>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa)\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap (cap_zombie_cap_lift (ret__struct_cap_C_' t))); \<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < word_bits
 2. \<And>finala capa \<sigma> x. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28; 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0; \<exists>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa)\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap (cap_zombie_cap_lift (ret__struct_cap_C_' t))); \<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> unat (2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) = unat ((capCNodePtr_CL (cap_cnode_cap_lift capa) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))))) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))))
 3. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>finala capa \<sigma> x. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28; 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0; \<exists>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa)\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap (cap_zombie_cap_lift (ret__struct_cap_C_' t))); \<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> unat (2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) = unat ((capCNodePtr_CL (cap_cnode_cap_lift capa) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))))) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))))
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>finala capa \<sigma> x n. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28; 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0; \<exists>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa)\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap (cap_zombie_cap_lift (ret__struct_cap_C_' t))); \<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> n < size (2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) \<longrightarrow> (2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) !! n = ((capCNodePtr_CL (cap_cnode_cap_lift capa) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))))) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))))) !! n
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>finala capa \<sigma> x n. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; \<forall>n<4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)). \<not> capCNodePtr_CL (cap_cnode_cap_lift capa) !! n; unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28; 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0; \<exists>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = capCNodePtr_CL (cap_cnode_cap_lift capa) || 2 ^ unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) && mask (Suc (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))), capZombieType_CL = capCNodeRadix_CL (cap_cnode_cap_lift capa)\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap (cap_zombie_cap_lift (ret__struct_cap_C_' t))); \<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> n < 32 \<longrightarrow> (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) = n) = ((capCNodePtr_CL (cap_cnode_cap_lift capa) !! n \<or> unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) = n \<and> n \<le> unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) \<and> n \<le> unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)))
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> 1 + capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>Some (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift capa)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))) (capCNodeGuard_CL (cap_cnode_cap_lift capa)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift capa)))) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; \<not> flag; (\<sigma>, x) \<in> rf_sr; finala; is_aligned (capCNodePtr_CL (cap_cnode_cap_lift capa)) (4 + unat (capCNodeRadix_CL (cap_cnode_cap_lift capa))); unat (capCNodeRadix_CL (cap_cnode_cap_lift capa)) < 28\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift capa) \<noteq> 0 - 1
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9462 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9464 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isThreadCap cap \<and> finala then let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od else if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> ?R9462 finala acap exposed final capa s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> ?T9464 finala acap exposed final capa v va vb)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q9758 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?S9761 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (let tcb = capTCBPtr cap in do cte_ptr <- getThreadCSpaceRoot tcb;
unbindNotification tcb;
ThreadDecls_H.suspend tcb;
prepareThreadDelete tcb;
return (capability.Zombie cte_ptr ZombieTCB 5, capability.NullCap)
od) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> ?Q9758 finala acap exposed final capa s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> ?S9761 finala acap exposed final capa v va vb) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q9758 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa) (?S9761 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (do a <- unbindNotification (capTCBPtr cap);
a <- ThreadDecls_H.suspend (capTCBPtr cap);
a <- prepareThreadDelete (capTCBPtr cap);
return (capability.Zombie (capTCBPtr cap + 2 ^ cte_level_bits * tcbCTableSlot) ZombieTCB 5, capability.NullCap)
od) (lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> ?Q9758 finala acap exposed final capa s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> ?S9761 finala acap exposed final capa v va vb) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q9758 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa) (?S9761 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (do a <- unbindNotification (capTCBPtr cap);
a <- ThreadDecls_H.suspend (capTCBPtr cap);
a <- prepareThreadDelete (capTCBPtr cap);
return (capability.Zombie (capTCBPtr cap + 2 ^ cte_level_bits * tcbCTableSlot) ZombieTCB 5, capability.NullCap)
od) (lvar_nondet_init tcb_' tcb_'_update;;
(lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
(\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
(CALL unbindNotification_'proc();;
(CALL suspend_'proc(\<acute>tcb);;
(CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
(\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))))))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> ?Q9758 finala acap exposed final capa s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> ?S9761 finala acap exposed final capa v va vb) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q9758 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa) (?G'9838 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (do a <- unbindNotification (capTCBPtr cap);
a <- ThreadDecls_H.suspend (capTCBPtr cap);
a <- prepareThreadDelete (capTCBPtr cap);
return (capability.Zombie (capTCBPtr cap + 2 ^ cte_level_bits * tcbCTableSlot) ZombieTCB 5, capability.NullCap)
od) (lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
(\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
(CALL unbindNotification_'proc();;
(CALL suspend_'proc(\<acute>tcb);;
(CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
(\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> ?Q9758 finala acap exposed final capa s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc. tcb_'_update (\<lambda>_. vc) s \<in> ?G'9838 finala acap exposed final capa v va vb}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q9758 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa) (?G'9857 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (do a <- unbindNotification (capTCBPtr cap);
a <- ThreadDecls_H.suspend (capTCBPtr cap);
a <- prepareThreadDelete (capTCBPtr cap);
return (capability.Zombie (capTCBPtr cap + 2 ^ cte_level_bits * tcbCTableSlot) ZombieTCB 5, capability.NullCap)
od) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
(\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
(CALL unbindNotification_'proc();;
(CALL suspend_'proc(\<acute>tcb);;
(CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
(\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> ?Q9758 finala acap exposed final capa s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc. tcb_'_update (\<lambda>_. vc) s \<in> {s. \<forall>vc. cte_ptr_'_update (\<lambda>_. vc) s \<in> ?G'9857 finala acap exposed final capa v va vb}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q9758 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa) (?G'9880 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) ret__unsigned) [SKIP] (do a <- unbindNotification (capTCBPtr cap);
a <- ThreadDecls_H.suspend (capTCBPtr cap);
a <- prepareThreadDelete (capTCBPtr cap);
return (capability.Zombie (capTCBPtr cap + 2 ^ cte_level_bits * tcbCTableSlot) ZombieTCB 5, capability.NullCap)
od) (\<acute>tcb :== tcb_Ptr ret__unsigned;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
(CALL unbindNotification_'proc(\<acute>tcb);;
(CALL suspend_'proc(\<acute>tcb);;
(CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
(\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> ?Q9758 finala acap exposed final capa s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc. tcb_'_update (\<lambda>_. vc) s \<in> {s. \<forall>vc. cte_ptr_'_update (\<lambda>_. vc) s \<in> {s. \<forall>vc v'. vc = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> ?G'9880 finala acap exposed final capa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q9758 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa) (?G'10247 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) ret__unsigned) [SKIP] (do a <- unbindNotification (capTCBPtr cap);
a <- ThreadDecls_H.suspend (capTCBPtr cap);
a <- prepareThreadDelete (capTCBPtr cap);
return (capability.Zombie (capTCBPtr cap + 2 ^ cte_level_bits * tcbCTableSlot) ZombieTCB 5, capability.NullCap)
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
(CALL unbindNotification_'proc(tcb_Ptr ret__unsigned);;
(CALL suspend_'proc(tcb_Ptr ret__unsigned);;
(CALL Arch_prepareThreadDelete_'proc(tcb_Ptr ret__unsigned);;
(\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> ?Q9758 finala acap exposed final capa s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc. tcb_'_update (\<lambda>_. vc) s \<in> {s. \<forall>vc. cte_ptr_'_update (\<lambda>_. vc) s \<in> {s. \<forall>vc v'. vc = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr vc) s \<in> ?G'10247 finala acap exposed final capa v va vb vc}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q9758 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa) (?C'10577 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) ret__unsigned) [SKIP] (do a <- unbindNotification (capTCBPtr cap);
a <- ThreadDecls_H.suspend (capTCBPtr cap);
a <- prepareThreadDelete (capTCBPtr cap);
return (capability.Zombie (capTCBPtr cap + 2 ^ cte_level_bits * tcbCTableSlot) ZombieTCB 5, capability.NullCap)
od) (\<acute>cte_ptr :== cte_Ptr ((ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)));;
(CALL unbindNotification_'proc(tcb_Ptr ret__unsigned);;
(CALL suspend_'proc(tcb_Ptr ret__unsigned);;
(CALL Arch_prepareThreadDelete_'proc(tcb_Ptr ret__unsigned);;
(\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> ?Q9758 finala acap exposed final capa s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc. tcb_'_update (\<lambda>_. vc) s \<in> {s. \<forall>vc. cte_ptr_'_update (\<lambda>_. vc) s \<in> {s. \<forall>vc v'. vc = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr vc) s \<in> ?C'10577 finala acap exposed final capa v va vb vc \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr vc) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q9758 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa) (?G'10589 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) ret__unsigned) [SKIP] (do a <- unbindNotification (capTCBPtr cap);
a <- ThreadDecls_H.suspend (capTCBPtr cap);
a <- prepareThreadDelete (capTCBPtr cap);
return (capability.Zombie (capTCBPtr cap + 2 ^ cte_level_bits * tcbCTableSlot) ZombieTCB 5, capability.NullCap)
od) (CALL unbindNotification_'proc(tcb_Ptr ret__unsigned);;
(CALL suspend_'proc(tcb_Ptr ret__unsigned);;
(CALL Arch_prepareThreadDelete_'proc(tcb_Ptr ret__unsigned);;
(\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val (cte_Ptr ((ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))));;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> ?Q9758 finala acap exposed final capa s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc. tcb_'_update (\<lambda>_. vc) s \<in> {s. \<forall>vc. cte_ptr_'_update (\<lambda>_. vc) s \<in> {s. \<forall>vc v'. vc = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr vc) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr vc) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> ?G'10589 finala acap exposed final capa v va vb vc} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr vc) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q10896 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv) (?Q'10910 acap capa ret__unsigned rv xfdc) [SKIP] (do a <- ThreadDecls_H.suspend (capTCBPtr cap);
a <- prepareThreadDelete (capTCBPtr cap);
return (capability.Zombie (capTCBPtr cap + 2 ^ cte_level_bits * tcbCTableSlot) ZombieTCB 5, capability.NullCap)
od) (CALL suspend_'proc(tcb_Ptr ret__unsigned);;
(CALL Arch_prepareThreadDelete_'proc(tcb_Ptr ret__unsigned);;
(\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val (cte_Ptr ((ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))));;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> unbindNotification (capTCBPtr cap) \<lbrace>?Q10896 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned\<rbrace>
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and ?R10904 finala acap exposed final capa) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc. tcb_'_update (\<lambda>_. vc) s \<in> {s. \<forall>vc. cte_ptr_'_update (\<lambda>_. vc) s \<in> {s. \<forall>vc v'. vc = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr vc) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr vc) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr vc) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'10909 finala acap exposed final capa v va vb vc t rv}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr vc) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}}
flex-flex pairs:
\<lambda>acap capa ret__unsigned t rv. ?Q'10910 acap capa ret__unsigned rv (xfdc t) \<equiv>\<^sup>? \<lambda>acap capa. ?Q'10909 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) proof (prove)
goal (5 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q10957 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva) (?Q'10976 acap capa ret__unsigned rv xfdca rva xfdc) [SKIP] (do a <- prepareThreadDelete (capTCBPtr cap);
return (capability.Zombie (capTCBPtr cap + 2 ^ cte_level_bits * tcbCTableSlot) ZombieTCB 5, capability.NullCap)
od) (CALL Arch_prepareThreadDelete_'proc(tcb_Ptr ret__unsigned);;
(\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val (cte_Ptr ((ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))));;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv\<rbrace> ThreadDecls_H.suspend (capTCBPtr cap) \<lbrace>?Q10957 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc\<rbrace>
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> unbindNotification (capTCBPtr cap) \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cap) and (\<lambda>s. capTCBPtr cap \<noteq> ksIdleThread s) and ?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned a\<rbrace>
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and ?R10904 finala acap exposed final capa) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc. tcb_'_update (\<lambda>_. vc) s \<in> {s. \<forall>vc. cte_ptr_'_update (\<lambda>_. vc) s \<in> {s. \<forall>vc v'. vc = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr vc) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr vc) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr vc) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr vc) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'10977 finala acap exposed final capa v va vb vc t rv ta rva}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr vc) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'10977 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned t rv ta rva. ?Q'10976 acap capa ret__unsigned rv (xfdc t) rva (xfdc ta) proof (prove)
goal (6 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdcb rvb xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdca; dc rva xfdcb; dc rvb xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q11025 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdcb rvb) (?Q'11043 acap capa ret__unsigned rv xfdca rva xfdcb rvb xfdc) [SKIP] (return (capability.Zombie (capTCBPtr cap + 2 ^ cte_level_bits * tcbCTableSlot) ZombieTCB 5, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val (cte_Ptr ((ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))));;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva\<rbrace> prepareThreadDelete (capTCBPtr cap) \<lbrace>?Q11025 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdc\<rbrace>
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv\<rbrace> ThreadDecls_H.suspend (capTCBPtr cap) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc a\<rbrace>
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> unbindNotification (capTCBPtr cap) \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cap) and (\<lambda>s. capTCBPtr cap \<noteq> ksIdleThread s) and ?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned a\<rbrace>
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and ?R10904 finala acap exposed final capa) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc. tcb_'_update (\<lambda>_. vc) s \<in> {s. \<forall>vc. cte_ptr_'_update (\<lambda>_. vc) s \<in> {s. \<forall>vc v'. vc = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr vc) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr vc) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr vc) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr vc) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr vc) s \<in> UNIV} \<inter> {s'. \<forall>tb rvb. dc rvb (xfdc tb) \<longrightarrow> s'\<lparr>globals := globals tb\<rparr> \<in> ?Q'11044 finala acap exposed final capa v va vb vc t rv ta rva tb rvb}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr vc) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'11044 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned t rv ta rva tb rvb. ?Q'11043 acap capa ret__unsigned rv (xfdc t) rva (xfdc ta) rvb (xfdc tb) proof (prove)
goal (6 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdcb rvb xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdca; dc rva xfdcb; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val (cte_Ptr ((ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))));;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.Zombie (capTCBPtr cap + 2 ^ cte_level_bits * tcbCTableSlot) ZombieTCB 5, capability.NullCap) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' s)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' s))}
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva\<rbrace> prepareThreadDelete (capTCBPtr cap) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv\<rbrace> ThreadDecls_H.suspend (capTCBPtr cap) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc a\<rbrace>
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> unbindNotification (capTCBPtr cap) \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cap) and (\<lambda>s. capTCBPtr cap \<noteq> ksIdleThread s) and ?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned a\<rbrace>
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and ?R10904 finala acap exposed final capa) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdcb rvb xfdc \<sigma>. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdca; dc rva xfdcb; dc rvb xfdc\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = ptr_val (cte_Ptr ((ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) && ~~ mask (if 0x20 = 1 << 5 then 5 else unat (0x20 + 1)) || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && mask (if 0x20 = 1 << 5 then 5 else unat (0x20 + 1)), capZombieType_CL = 0x20 && mask 6\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (\<forall>ta. cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return (capability.Zombie (capTCBPtr cap + 2 ^ cte_level_bits * tcbCTableSlot) ZombieTCB 5, capability.NullCap) \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' ta, fc_ret_' := finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' ta) (remainder_C_update (\<lambda>_. ret__struct_cap_C_' t) (fc_ret_' s)), ret__struct_finaliseCap_ret_C_' := finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' ta) (remainder_C_update (\<lambda>_. ret__struct_cap_C_' t) (fc_ret_' s)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation (fst rv) (remainder_C (finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' ta) (remainder_C_update (\<lambda>_. ret__struct_cap_C_' t) (fc_ret_' s)))) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' ta) (remainder_C_update (\<lambda>_. ret__struct_cap_C_' t) (fc_ret_' s))))))}
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva\<rbrace> prepareThreadDelete (capTCBPtr cap) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv\<rbrace> ThreadDecls_H.suspend (capTCBPtr cap) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc a\<rbrace>
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> unbindNotification (capTCBPtr cap) \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cap) and (\<lambda>s. capTCBPtr cap \<noteq> ksIdleThread s) and ?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned a\<rbrace>
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and ?R10904 finala acap exposed final capa) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>capAligned cap; ccap_relation cap capa; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; (\<sigma>, x) \<in> rf_sr; \<not> isEndpointCap cap; isThreadCap cap; finala; \<not> isNotificationCap cap; \<not> isReplyCap cap; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && ~~ mask 5 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && mask 5, capZombieType_CL = 0x20 && mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> ccap_relation (capability.Zombie (capTCBPtr cap + 2 ^ cte_level_bits * tcbCTableSlot) ZombieTCB 5) (ret__struct_cap_C_' t) \<and> ccap_relation capability.NullCap (ret__struct_cap_C_' ta)
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva\<rbrace> prepareThreadDelete (capTCBPtr cap) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv\<rbrace> ThreadDecls_H.suspend (capTCBPtr cap) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc a\<rbrace>
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> unbindNotification (capTCBPtr cap) \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cap) and (\<lambda>s. capTCBPtr cap \<noteq> ksIdleThread s) and ?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned a\<rbrace>
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and ?R10904 finala acap exposed final capa) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (7 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>capAligned cap; ccap_relation cap capa; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; (\<sigma>, x) \<in> rf_sr; \<not> isEndpointCap cap; isThreadCap cap; finala; \<not> isNotificationCap cap; \<not> isReplyCap cap; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && ~~ mask 5 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && mask 5, capZombieType_CL = 0x20 && mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrakk> \<Longrightarrow> ccap_relation (capability.Zombie (capTCBPtr cap + 2 ^ cte_level_bits * tcbCTableSlot) ZombieTCB 5) (ret__struct_cap_C_' t) \<and> ccap_relation capability.NullCap (ret__struct_cap_C_' ta)
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>capAligned cap; ccap_relation cap capa; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; (\<sigma>, x) \<in> rf_sr; \<not> isEndpointCap cap; isThreadCap cap; finala; \<not> isNotificationCap cap; \<not> isReplyCap cap; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && ~~ mask 5 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && mask 5, capZombieType_CL = 0x20 && mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_thread_cap
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva\<rbrace> prepareThreadDelete (capTCBPtr cap) \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv\<rbrace> ThreadDecls_H.suspend (capTCBPtr cap) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc a\<rbrace>
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> unbindNotification (capTCBPtr cap) \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cap) and (\<lambda>s. capTCBPtr cap \<noteq> ksIdleThread s) and ?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned a\<rbrace>
 6. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and ?R10904 finala acap exposed final capa) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (7 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>capAligned cap; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; (\<sigma>, x) \<in> rf_sr; \<not> isEndpointCap cap; isThreadCap cap; finala; \<not> isNotificationCap cap; \<not> isReplyCap cap; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && ~~ mask 5 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && mask 5, capZombieType_CL = 0x20 && mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; cap = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa))))\<rbrakk> \<Longrightarrow> ccap_relation (capability.Zombie (capTCBPtr cap + 2 ^ cte_level_bits * tcbCTableSlot) ZombieTCB 5) (ret__struct_cap_C_' t) \<and> ccap_relation capability.NullCap (ret__struct_cap_C_' ta)
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>capAligned cap; ccap_relation cap capa; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; (\<sigma>, x) \<in> rf_sr; \<not> isEndpointCap cap; isThreadCap cap; finala; \<not> isNotificationCap cap; \<not> isReplyCap cap; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && ~~ mask 5 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && mask 5, capZombieType_CL = 0x20 && mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_thread_cap
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva\<rbrace> prepareThreadDelete (capTCBPtr cap) \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv\<rbrace> ThreadDecls_H.suspend (capTCBPtr cap) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc a\<rbrace>
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> unbindNotification (capTCBPtr cap) \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cap) and (\<lambda>s. capTCBPtr cap \<noteq> ksIdleThread s) and ?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned a\<rbrace>
 6. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and ?R10904 finala acap exposed final capa) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (7 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>\<not> flag; (\<sigma>, x) \<in> rf_sr; finala; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && ~~ mask 5 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && mask 5, capZombieType_CL = 0x20 && mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; cap = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)))); is_aligned (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)))) (objBits undefined); objBits undefined < word_bits\<rbrakk> \<Longrightarrow> ccap_relation (capability.Zombie (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa))) + 2 ^ cte_level_bits * tcbCTableSlot) ZombieTCB 5) (ret__struct_cap_C_' t)
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>capAligned cap; ccap_relation cap capa; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; (\<sigma>, x) \<in> rf_sr; \<not> isEndpointCap cap; isThreadCap cap; finala; \<not> isNotificationCap cap; \<not> isReplyCap cap; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && ~~ mask 5 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && mask 5, capZombieType_CL = 0x20 && mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_thread_cap
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva\<rbrace> prepareThreadDelete (capTCBPtr cap) \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv\<rbrace> ThreadDecls_H.suspend (capTCBPtr cap) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc a\<rbrace>
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> unbindNotification (capTCBPtr cap) \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cap) and (\<lambda>s. capTCBPtr cap \<noteq> ksIdleThread s) and ?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned a\<rbrace>
 6. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and ?R10904 finala acap exposed final capa) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (7 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>\<not> flag; (\<sigma>, x) \<in> rf_sr; finala; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && ~~ mask 5 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && mask 5, capZombieType_CL = 0x20 && mask 6\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap \<lparr>capZombieID_CL = (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && ~~ mask 5 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && mask 5, capZombieType_CL = 0x20 && mask 6\<rparr>); cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; cap = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)))); is_aligned (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)))) (objBits undefined); objBits undefined < word_bits\<rbrakk> \<Longrightarrow> capability.Zombie (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa))) + 2 ^ cte_level_bits * tcbCTableSlot) ZombieTCB 5 = cap_to_H (Cap_zombie_cap \<lparr>capZombieID_CL = (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && ~~ mask 5 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && mask 5, capZombieType_CL = 0x20 && mask 6\<rparr>)
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>capAligned cap; ccap_relation cap capa; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; (\<sigma>, x) \<in> rf_sr; \<not> isEndpointCap cap; isThreadCap cap; finala; \<not> isNotificationCap cap; \<not> isReplyCap cap; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && ~~ mask 5 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && mask 5, capZombieType_CL = 0x20 && mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_thread_cap
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva\<rbrace> prepareThreadDelete (capTCBPtr cap) \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv\<rbrace> ThreadDecls_H.suspend (capTCBPtr cap) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc a\<rbrace>
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> unbindNotification (capTCBPtr cap) \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cap) and (\<lambda>s. capTCBPtr cap \<noteq> ksIdleThread s) and ?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned a\<rbrace>
 6. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and ?R10904 finala acap exposed final capa) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (7 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>\<not> flag; (\<sigma>, x) \<in> rf_sr; finala; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && 0xFFFFFFE0 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && 0x1F, capZombieType_CL = 0x20\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap \<lparr>capZombieID_CL = (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && 0xFFFFFFE0 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && 0x1F, capZombieType_CL = 0x20\<rparr>); cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; cap = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)))); is_aligned (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)))) (objBits undefined); objBits undefined < word_bits\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa))) + 2 ^ cte_level_bits * tcbCTableSlot = ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && 0xFFFFFFE0 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && 0x1F) && 0xFFFFFFE0 \<and> unat (((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && 0xFFFFFFE0 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && 0x1F) && 0x1F) = 5
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>capAligned cap; ccap_relation cap capa; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; (\<sigma>, x) \<in> rf_sr; \<not> isEndpointCap cap; isThreadCap cap; finala; \<not> isNotificationCap cap; \<not> isReplyCap cap; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && ~~ mask 5 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && mask 5, capZombieType_CL = 0x20 && mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_thread_cap
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva\<rbrace> prepareThreadDelete (capTCBPtr cap) \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv\<rbrace> ThreadDecls_H.suspend (capTCBPtr cap) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc a\<rbrace>
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> unbindNotification (capTCBPtr cap) \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cap) and (\<lambda>s. capTCBPtr cap \<noteq> ksIdleThread s) and ?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned a\<rbrace>
 6. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and ?R10904 finala acap exposed final capa) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (7 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>\<not> flag; (\<sigma>, x) \<in> rf_sr; finala; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00 || 5, capZombieType_CL = 0x20\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap \<lparr>capZombieID_CL = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00 || 5, capZombieType_CL = 0x20\<rparr>); cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; cap = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)))); is_aligned (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)))) (objBits undefined); objBits undefined < word_bits\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa))) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>capAligned cap; ccap_relation cap capa; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; (\<sigma>, x) \<in> rf_sr; \<not> isEndpointCap cap; isThreadCap cap; finala; \<not> isNotificationCap cap; \<not> isReplyCap cap; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && ~~ mask 5 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && mask 5, capZombieType_CL = 0x20 && mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_thread_cap
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva\<rbrace> prepareThreadDelete (capTCBPtr cap) \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv\<rbrace> ThreadDecls_H.suspend (capTCBPtr cap) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc a\<rbrace>
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> unbindNotification (capTCBPtr cap) \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cap) and (\<lambda>s. capTCBPtr cap \<noteq> ksIdleThread s) and ?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned a\<rbrace>
 6. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and ?R10904 finala acap exposed final capa) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (7 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>\<not> flag; (\<sigma>, x) \<in> rf_sr; finala; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00 || 5, capZombieType_CL = 0x20\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap \<lparr>capZombieID_CL = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00 || 5, capZombieType_CL = 0x20\<rparr>); cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; cap = capability.ThreadCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) - ctcb_offset); is_aligned (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) - ctcb_offset) tcbBlockSizeBits; tcbBlockSizeBits < word_bits\<rbrakk> \<Longrightarrow> cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) - ctcb_offset = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>capAligned cap; ccap_relation cap capa; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; (\<sigma>, x) \<in> rf_sr; \<not> isEndpointCap cap; isThreadCap cap; finala; \<not> isNotificationCap cap; \<not> isReplyCap cap; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && ~~ mask 5 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && mask 5, capZombieType_CL = 0x20 && mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_thread_cap
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva\<rbrace> prepareThreadDelete (capTCBPtr cap) \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv\<rbrace> ThreadDecls_H.suspend (capTCBPtr cap) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc a\<rbrace>
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> unbindNotification (capTCBPtr cap) \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cap) and (\<lambda>s. capTCBPtr cap \<noteq> ksIdleThread s) and ?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned a\<rbrace>
 6. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and ?R10904 finala acap exposed final capa) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (8 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>\<not> flag; (\<sigma>, x) \<in> rf_sr; finala; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00 || 5, capZombieType_CL = 0x20\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap \<lparr>capZombieID_CL = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00 || 5, capZombieType_CL = 0x20\<rparr>); cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; cap = capability.ThreadCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) - ctcb_offset); is_aligned (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) - ctcb_offset) tcbBlockSizeBits; tcbBlockSizeBits < word_bits\<rbrakk> \<Longrightarrow> ctcb_offset < 2 ^ tcbBlockSizeBits
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>\<not> flag; (\<sigma>, x) \<in> rf_sr; finala; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00 || 5, capZombieType_CL = 0x20\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap \<lparr>capZombieID_CL = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00 || 5, capZombieType_CL = 0x20\<rparr>); cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; cap = capability.ThreadCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) - ctcb_offset); is_aligned (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) - ctcb_offset) tcbBlockSizeBits; tcbBlockSizeBits < word_bits; cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) - ctcb_offset + ctcb_offset && mask tcbBlockSizeBits = ctcb_offset \<and> cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) - ctcb_offset + ctcb_offset && ~~ mask tcbBlockSizeBits = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) - ctcb_offset\<rbrakk> \<Longrightarrow> cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) - ctcb_offset = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00
 3. \<And>finala capa \<sigma> x t ta. \<lbrakk>capAligned cap; ccap_relation cap capa; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; (\<sigma>, x) \<in> rf_sr; \<not> isEndpointCap cap; isThreadCap cap; finala; \<not> isNotificationCap cap; \<not> isReplyCap cap; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && ~~ mask 5 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && mask 5, capZombieType_CL = 0x20 && mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_thread_cap
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva\<rbrace> prepareThreadDelete (capTCBPtr cap) \<lbrace>\<lambda>a b. True\<rbrace>
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv\<rbrace> ThreadDecls_H.suspend (capTCBPtr cap) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc a\<rbrace>
 6. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> unbindNotification (capTCBPtr cap) \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cap) and (\<lambda>s. capTCBPtr cap \<noteq> ksIdleThread s) and ?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned a\<rbrace>
 7. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 8. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and ?R10904 finala acap exposed final capa) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (7 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>\<not> flag; (\<sigma>, x) \<in> rf_sr; finala; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00 || 5, capZombieType_CL = 0x20\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_zombie_cap \<lparr>capZombieID_CL = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00 || 5, capZombieType_CL = 0x20\<rparr>); cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; cap = capability.ThreadCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) - ctcb_offset); is_aligned (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) - ctcb_offset) tcbBlockSizeBits; tcbBlockSizeBits < word_bits; cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) - ctcb_offset + ctcb_offset && mask tcbBlockSizeBits = ctcb_offset \<and> cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) - ctcb_offset + ctcb_offset && ~~ mask tcbBlockSizeBits = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) - ctcb_offset\<rbrakk> \<Longrightarrow> cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) - ctcb_offset = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00
 2. \<And>finala capa \<sigma> x t ta. \<lbrakk>capAligned cap; ccap_relation cap capa; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; (\<sigma>, x) \<in> rf_sr; \<not> isEndpointCap cap; isThreadCap cap; finala; \<not> isNotificationCap cap; \<not> isReplyCap cap; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && ~~ mask 5 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && mask 5, capZombieType_CL = 0x20 && mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_thread_cap
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva\<rbrace> prepareThreadDelete (capTCBPtr cap) \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv\<rbrace> ThreadDecls_H.suspend (capTCBPtr cap) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc a\<rbrace>
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> unbindNotification (capTCBPtr cap) \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cap) and (\<lambda>s. capTCBPtr cap \<noteq> ksIdleThread s) and ?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned a\<rbrace>
 6. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and ?R10904 finala acap exposed final capa) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>finala capa \<sigma> x t ta. \<lbrakk>capAligned cap; ccap_relation cap capa; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; (\<sigma>, x) \<in> rf_sr; \<not> isEndpointCap cap; isThreadCap cap; finala; \<not> isNotificationCap cap; \<not> isReplyCap cap; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; cap_zombie_cap_lift (ret__struct_cap_C_' t) = \<lparr>capZombieID_CL = (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) && ~~ mask 5 || SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries && mask 5, capZombieType_CL = 0x20 && mask 6\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_thread_cap
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva\<rbrace> prepareThreadDelete (capTCBPtr cap) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv\<rbrace> ThreadDecls_H.suspend (capTCBPtr cap) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc a\<rbrace>
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> unbindNotification (capTCBPtr cap) \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cap) and (\<lambda>s. capTCBPtr cap \<noteq> ksIdleThread s) and ?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned a\<rbrace>
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and ?R10904 finala acap exposed final capa) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (5 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdca rva\<rbrace> prepareThreadDelete (capTCBPtr cap) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv\<rbrace> ThreadDecls_H.suspend (capTCBPtr cap) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R11038 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv xfdc a\<rbrace>
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; isThreadCap cap \<and> finala; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R10904 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> unbindNotification (capTCBPtr cap) \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cap) and (\<lambda>s. capTCBPtr cap \<noteq> ksIdleThread s) and ?R10970 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned a\<rbrace>
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and ?R10904 finala acap exposed final capa) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R9757 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T9759 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> finala then let z = cap in return (z, capability.NullCap) else if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> ?R9757 finala acap exposed final capa s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> ?T9759 finala acap exposed final capa v va vb)})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala); isZombie cap \<and> finala\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q11240 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?S11243 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (let z = cap in return (z, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala); \<not> (isZombie cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11239 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11241 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> ?Q11240 finala acap exposed final capa s) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> ?R11239 finala acap exposed final capa s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> ?S11243 finala acap exposed final capa v va vb) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> ?T11241 finala acap exposed final capa v va vb)})})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> isCNodeCap cap; \<not> isThreadCap cap; isZombie cap \<and> finala\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q11240 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa) (?S11243 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (return (cap, capability.NullCap)) (\<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala); \<not> (isZombie cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11239 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11241 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> ?Q11240 finala acap exposed final capa s) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> ?R11239 finala acap exposed final capa s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> ?S11243 finala acap exposed final capa v va vb) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> ?T11241 finala acap exposed final capa v va vb)})})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> isCNodeCap cap; \<not> isThreadCap cap; isZombie cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (cap, capability.NullCap) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' s)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' s))}
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala); \<not> (isZombie cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11239 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11241 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> ?R11239 finala acap exposed final capa s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> ?T11241 finala acap exposed final capa v va vb)})})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned \<sigma>. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> isCNodeCap cap; \<not> isThreadCap cap; isZombie cap \<and> finala\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return (cap, capability.NullCap) \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' t, fc_ret_' := finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' t) (remainder_C_update (\<lambda>_. capa) (fc_ret_' s)), ret__struct_finaliseCap_ret_C_' := finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' t) (remainder_C_update (\<lambda>_. capa) (fc_ret_' s)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation (fst rv) (remainder_C (finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' t) (remainder_C_update (\<lambda>_. capa) (fc_ret_' s)))) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' t) (remainder_C_update (\<lambda>_. capa) (fc_ret_' s)))))}
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala); \<not> (isZombie cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11239 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11241 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> ?R11239 finala acap exposed final capa s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> ?T11241 finala acap exposed final capa v va vb)})})}})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> (isCNodeCap cap \<and> finala); \<not> (isThreadCap cap \<and> finala); \<not> (isZombie cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11239 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11241 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isArchObjectCap cap then let cap = capCap cap in Let finala (Arch.finaliseCap cap) else if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> ?R11239 finala acap exposed final capa s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> ?T11241 finala acap exposed final capa v va vb)})})}})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11239 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11241 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isIRQHandlerCap cap \<and> finala then let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od else if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> ?R11239 finala acap exposed final capa s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> ?T11241 finala acap exposed final capa v va vb)})})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q11350 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?S11353 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (let irq = capIRQ cap; cap = cap in do deletingIRQHandler irq;
return (capability.NullCap, cap)
od) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11349 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11351 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> ?Q11350 finala acap exposed final capa s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> ?R11349 finala acap exposed final capa s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> ?S11353 finala acap exposed final capa v va vb) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> ?T11351 finala acap exposed final capa v va vb)})})})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q11350 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa) (?S11353 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (do a <- deletingIRQHandler (capIRQ cap);
return (capability.NullCap, cap)
od) (\<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11349 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11351 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> ?Q11350 finala acap exposed final capa s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> ?R11349 finala acap exposed final capa s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> ?S11353 finala acap exposed final capa v va vb) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> ?T11351 finala acap exposed final capa v va vb)})})})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap \<and> finala; capIRQ cap \<le> local.maxIRQ\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G11388 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa) (?S11353 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (do a <- deletingIRQHandler (capIRQ cap);
return (capability.NullCap, cap)
od) (\<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11349 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11351 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (?G11388 finala acap exposed final capa and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> ?R11349 finala acap exposed final capa s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> ?S11353 finala acap exposed final capa v va vb) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> ?T11351 finala acap exposed final capa v va vb)})})})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap \<and> finala; capIRQ cap \<le> local.maxIRQ\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G11388 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa) (?S11353 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (do a <- deletingIRQHandler (capIRQ cap);
return (capability.NullCap, cap)
od) (\<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
(\<acute>irq :== \<acute>ret__unsigned;;
(CALL deletingIRQHandler_'proc();;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
(return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11349 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11351 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (?G11388 finala acap exposed final capa and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> ?R11349 finala acap exposed final capa s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> ?S11353 finala acap exposed final capa v va vb) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> ?T11351 finala acap exposed final capa v va vb)})})})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap \<and> finala; capIRQ cap \<le> local.maxIRQ; ret__unsigned = capIRQ_CL (cap_irq_handler_cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G11388 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa) (?G'11425 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) ret__unsigned) [SKIP] (do a <- deletingIRQHandler (capIRQ cap);
return (capability.NullCap, cap)
od) (\<acute>irq :== ret__unsigned;;
(CALL deletingIRQHandler_'proc(\<acute>irq);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
(return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11349 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11351 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (?G11388 finala acap exposed final capa and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> ?R11349 finala acap exposed final capa s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> ?G'11425 finala acap exposed final capa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> ?T11351 finala acap exposed final capa v va vb)})})})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap \<and> finala; capIRQ cap \<le> local.maxIRQ; ret__unsigned = capIRQ_CL (cap_irq_handler_cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G11388 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa) (?G'11693 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) ret__unsigned) [SKIP] (do a <- deletingIRQHandler (capIRQ cap);
return (capability.NullCap, cap)
od) (CALL deletingIRQHandler_'proc(ret__unsigned);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
(return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11349 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11351 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (?G11388 finala acap exposed final capa and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> ?R11349 finala acap exposed final capa s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> ?G'11693 finala acap exposed final capa v va vb vc}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> ?T11351 finala acap exposed final capa v va vb)})})})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap \<and> finala; capIRQ cap \<le> local.maxIRQ; ret__unsigned = capIRQ_CL (cap_irq_handler_cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G11388 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa) (?G'11925 acap capa ret__unsigned rv') [SKIP] (do a <- deletingIRQHandler (capIRQ cap);
return (capability.NullCap, cap)
od) (CALL deletingIRQHandler_'proc(ret__unsigned);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
(return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11349 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11351 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (?G11388 finala acap exposed final capa and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> ?R11349 finala acap exposed final capa s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> ?G'11923 finala acap exposed final capa v va vb vc s}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> ?T11351 finala acap exposed final capa v va vb)})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa ret__unsigned s. ?G'11925 acap capa ret__unsigned (irq_' s) \<equiv>\<^sup>? \<lambda>acap capa. ?G'11923 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap \<and> finala; capIRQ cap \<le> local.maxIRQ; ret__unsigned = capIRQ_CL (cap_irq_handler_cap_lift capa); rv' = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G11388 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa) (?G'12198 acap capa ret__unsigned rv') [SKIP] (do a <- deletingIRQHandler (capIRQ cap);
return (capability.NullCap, cap)
od) (CALL deletingIRQHandler_'proc(ret__unsigned);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
(return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11349 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11351 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (?G11388 finala acap exposed final capa and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> ?R11349 finala acap exposed final capa s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> ?G'12196 finala acap exposed final capa v va vb vc s \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> ?T11351 finala acap exposed final capa v va vb)})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa ret__unsigned s. ?G'12198 acap capa ret__unsigned (irq_' s) \<equiv>\<^sup>? \<lambda>acap capa. ?G'12196 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) proof (prove)
goal (4 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv' rv xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap \<and> finala; capIRQ cap \<le> local.maxIRQ; ret__unsigned = capIRQ_CL (cap_irq_handler_cap_lift capa); rv' = UCAST(10 \<rightarrow> 32) (capIRQ cap); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q12203 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv' rv) (?Q'12221 acap capa ret__unsigned rv' rv xfdc) [SKIP] (return (capability.NullCap, cap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
(return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap \<and> finala; capIRQ cap \<le> local.maxIRQ; ret__unsigned = capIRQ_CL (cap_irq_handler_cap_lift capa); rv' = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R12215 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> deletingIRQHandler (capIRQ cap) \<lbrace>?Q12203 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv'\<rbrace>
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11349 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11351 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and ?R12215 finala acap exposed final capa and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> ?R11349 finala acap exposed final capa s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> ?T11351 finala acap exposed final capa v va vb)})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (4 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv' rv xfdc. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap \<and> finala; capIRQ cap \<le> local.maxIRQ; ret__unsigned = capIRQ_CL (cap_irq_handler_cap_lift capa); rv' = UCAST(10 \<rightarrow> 32) (capIRQ cap); dc rv xfdc\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> ?Q'12221 acap capa ret__unsigned rv' rv xfdc \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
(return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_';;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.NullCap, cap) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' s)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' s))}
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap \<and> finala; capIRQ cap \<le> local.maxIRQ; ret__unsigned = capIRQ_CL (cap_irq_handler_cap_lift capa); rv' = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R12215 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> deletingIRQHandler (capIRQ cap) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11349 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11351 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and ?R12215 finala acap exposed final capa and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> ?R11349 finala acap exposed final capa s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> ?T11351 finala acap exposed final capa v va vb)})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (4 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv' rv xfdc \<sigma>. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap \<and> finala; capIRQ cap \<le> local.maxIRQ; ret__unsigned = capIRQ_CL (cap_irq_handler_cap_lift capa); rv' = UCAST(10 \<rightarrow> 32) (capIRQ cap); dc rv xfdc\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> ?Q'12221 acap capa ret__unsigned rv' rv xfdc \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return (capability.NullCap, cap) \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' t, fc_ret_' := finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) (remainder_C_update (\<lambda>_. ret__struct_cap_C_' t) (fc_ret_' s)), ret__struct_finaliseCap_ret_C_' := finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) (remainder_C_update (\<lambda>_. ret__struct_cap_C_' t) (fc_ret_' s)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation (fst rv) (remainder_C (finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) (remainder_C_update (\<lambda>_. ret__struct_cap_C_' t) (fc_ret_' s)))) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) (remainder_C_update (\<lambda>_. ret__struct_cap_C_' t) (fc_ret_' s)))))}
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap \<and> finala; capIRQ cap \<le> local.maxIRQ; ret__unsigned = capIRQ_CL (cap_irq_handler_cap_lift capa); rv' = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R12215 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> deletingIRQHandler (capIRQ cap) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11349 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11351 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and ?R12215 finala acap exposed final capa and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> ?R11349 finala acap exposed final capa s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> ?T11351 finala acap exposed final capa v va vb)})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (4 subgoals):
 1. \<And>finala acap capa xfdc \<sigma> x t. \<lbrakk>capAligned cap; 0 \<le>s - 1 \<or> acap = capCap cap; ccap_relation cap capa; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; capIRQ cap \<le> local.maxIRQ; \<not> isEndpointCap cap; isIRQHandlerCap cap; finala; x \<in> ?Q'12221 acap capa (capIRQ_CL (cap_irq_handler_cap_lift capa)) (UCAST(10 \<rightarrow> 32) (capIRQ cap)) () xfdc; (\<sigma>, x) \<in> rf_sr; \<not> isNotificationCap cap; \<not> isReplyCap cap; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' t)
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap \<and> finala; capIRQ cap \<le> local.maxIRQ; ret__unsigned = capIRQ_CL (cap_irq_handler_cap_lift capa); rv' = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R12215 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> deletingIRQHandler (capIRQ cap) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11349 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11351 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and ?R12215 finala acap exposed final capa and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> ?R11349 finala acap exposed final capa s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> ?T11351 finala acap exposed final capa v va vb)})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (4 subgoals):
 1. \<And>finala acap capa xfdc \<sigma> x t. \<lbrakk>capAligned cap; 0 \<le>s - 1 \<or> acap = capCap cap; ccap_relation cap capa; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; capIRQ cap \<le> local.maxIRQ; \<not> isEndpointCap cap; isIRQHandlerCap cap; finala; x \<in> ?Q'12221 acap capa (capIRQ_CL (cap_irq_handler_cap_lift capa)) (UCAST(10 \<rightarrow> 32) (capIRQ cap)) () xfdc; (\<sigma>, x) \<in> rf_sr; \<not> isNotificationCap cap; \<not> isReplyCap cap; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap = capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift capa)))\<rbrakk> \<Longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' t)
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap \<and> finala; capIRQ cap \<le> local.maxIRQ; ret__unsigned = capIRQ_CL (cap_irq_handler_cap_lift capa); rv' = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R12215 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> deletingIRQHandler (capIRQ cap) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11349 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11351 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and ?R12215 finala acap exposed final capa and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> ?R11349 finala acap exposed final capa s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> ?T11351 finala acap exposed final capa v va vb)})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsignedb ret__unsigned rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsignedb = cap_get_tag capa; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap \<and> finala; capIRQ cap \<le> local.maxIRQ; ret__unsigned = capIRQ_CL (cap_irq_handler_cap_lift capa); rv' = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R12215 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa\<rbrace> deletingIRQHandler (capIRQ cap) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11349 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11351 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and ?R12215 finala acap exposed final capa and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> ?R11349 finala acap exposed final capa s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> ?T11351 finala acap exposed final capa v va vb)})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (2 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R11349 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T11351 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (if isZombie cap \<and> \<not> finala then haskell_fail [] else return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> ?R11349 finala acap exposed final capa s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> ?T11351 finala acap exposed final capa v va vb)})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); isZombie cap \<and> \<not> finala\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q12369 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?S12372 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (haskell_fail []) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R12368 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T12370 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> ?Q12369 finala acap exposed final capa s) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ?R12368 finala acap exposed final capa s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> ?S12372 finala acap exposed final capa v va vb) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> ?T12370 finala acap exposed final capa v va vb)})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) false; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isZombie cap \<and> \<not> finala\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q12369 False acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) false) capa) (?S12372 False acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) false) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] fail (Cond (if isCNodeCap cap then UNIV else {}) (Cond {} (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP) (Cond (if isThreadCap cap then UNIV else {}) (Cond {} (lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP) (Cond UNIV (\<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') (Cond (if isIRQHandlerCap cap then UNIV else {}) (Cond {} (\<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_') SKIP) SKIP)));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R12368 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T12370 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> ?Q12369 finala acap exposed final capa s) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ?R12368 finala acap exposed final capa s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> ?S12372 finala acap exposed final capa v va vb) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> ?T12370 finala acap exposed final capa v va vb)})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (2 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?R12368 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T12370 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [SKIP] (return (capability.NullCap, capability.NullCap)) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ?R12368 finala acap exposed final capa s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> ?T12370 finala acap exposed final capa v va vb)})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (6 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P12410 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T12370 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) (IF isCNodeCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI
FI)
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv' t t'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_) (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv') [SKIP] (return (capability.NullCap, capability.NullCap)) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> \<lbrace>?R12408 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> return () \<lbrace>?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned)
 6. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> (?P12410 finala acap exposed final capa and ?R12408 finala acap exposed final capa) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> ?T12370 finala acap exposed final capa v va vb)})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (7 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); isCNodeCap cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q12421 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?S12424 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) (IF finala THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(capa);;
\<acute>unsigned_eret_3 :== CALL cap_cnode_cap_get_capCNodePtr_'proc(capa);;
Guard ShiftError \<lbrace>\<acute>ret__unsigned < 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(2 ^ unat \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3));;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI)
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); \<not> isCNodeCap cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R12420 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T12422 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) (IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI)
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv' t t'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_) (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv') [SKIP] (return (capability.NullCap, capability.NullCap)) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> \<lbrace>?R12408 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> return () \<lbrace>?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 6. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned)
 7. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ((\<lambda>a. (isCNodeCap cap \<longrightarrow> ?Q12421 finala acap exposed final capa a) \<and> (\<not> isCNodeCap cap \<longrightarrow> ?R12420 finala acap exposed final capa a)) and ?R12408 finala acap exposed final capa) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> {s. (isCNodeCap cap \<longrightarrow> s \<in> ?S12424 finala acap exposed final capa v va vb) \<and> (\<not> isCNodeCap cap \<longrightarrow> s \<in> ?T12422 finala acap exposed final capa v va vb)})})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (7 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) false; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> finala; \<not> isZombie cap; isCNodeCap cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q12421 False acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) false) capa) (?S12424 False acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) false) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) SKIP
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); \<not> isCNodeCap cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R12420 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T12422 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) (IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI)
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv' t t'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_) (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv') [SKIP] (return (capability.NullCap, capability.NullCap)) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> \<lbrace>?R12408 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> return () \<lbrace>?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 6. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned)
 7. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ((\<lambda>a. (isCNodeCap cap \<longrightarrow> ?Q12421 finala acap exposed final capa a) \<and> (\<not> isCNodeCap cap \<longrightarrow> ?R12420 finala acap exposed final capa a)) and ?R12408 finala acap exposed final capa) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> {s. (isCNodeCap cap \<longrightarrow> s \<in> ?S12424 finala acap exposed final capa v va vb) \<and> (\<not> isCNodeCap cap \<longrightarrow> s \<in> ?T12422 finala acap exposed final capa v va vb)})})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (6 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); \<not> isCNodeCap cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R12420 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T12422 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) (IF isThreadCap cap THEN
  IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
ELSE
  IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI
FI)
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv' t t'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_) (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv') [SKIP] (return (capability.NullCap, capability.NullCap)) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> \<lbrace>?R12408 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> return () \<lbrace>?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned)
 6. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ((\<lambda>a. (isCNodeCap cap \<longrightarrow> True) \<and> (\<not> isCNodeCap cap \<longrightarrow> ?R12420 finala acap exposed final capa a)) and ?R12408 finala acap exposed final capa) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> {s. (isCNodeCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isCNodeCap cap \<longrightarrow> s \<in> ?T12422 finala acap exposed final capa v va vb)})})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (7 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); \<not> isCNodeCap cap; isThreadCap cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q12456 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?S12459 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) (IF finala THEN
  lvar_nondet_init tcb_' tcb_'_update;;
lvar_nondet_init cte_ptr_' cte_ptr_'_update;;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(capa);;
\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>tcb && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cte_ptr :== cte_Ptr ((ptr_val \<acute>tcb && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
CALL unbindNotification_'proc();;
CALL suspend_'proc(\<acute>tcb);;
CALL Arch_prepareThreadDelete_'proc(\<acute>tcb);;
\<acute>ret__struct_cap_C :== CALL Zombie_new_'proc(SCAST(32 signed \<rightarrow> 32) tcbCNodeEntries,0x20,ptr_val \<acute>cte_ptr);;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI)
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); \<not> isCNodeCap cap; \<not> isThreadCap cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R12455 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T12457 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) (IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI)
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv' t t'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_) (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv') [SKIP] (return (capability.NullCap, capability.NullCap)) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> \<lbrace>?R12408 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> return () \<lbrace>?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 6. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned)
 7. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ((\<lambda>a. (isCNodeCap cap \<longrightarrow> True) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> ?Q12456 finala acap exposed final capa a) \<and> (\<not> isThreadCap cap \<longrightarrow> ?R12455 finala acap exposed final capa a))) and ?R12408 finala acap exposed final capa) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> {s. (isCNodeCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isCNodeCap cap \<longrightarrow> s \<in> {s. (isThreadCap cap \<longrightarrow> s \<in> ?S12459 finala acap exposed final capa v va vb) \<and> (\<not> isThreadCap cap \<longrightarrow> s \<in> ?T12457 finala acap exposed final capa v va vb)})})})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (7 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) false; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> finala; \<not> isZombie cap; \<not> isCNodeCap cap; isThreadCap cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q12456 False acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) false) capa) (?S12459 False acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) false) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) SKIP
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); \<not> isCNodeCap cap; \<not> isThreadCap cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R12455 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T12457 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) (IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI)
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv' t t'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_) (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv') [SKIP] (return (capability.NullCap, capability.NullCap)) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> \<lbrace>?R12408 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> return () \<lbrace>?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 6. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned)
 7. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ((\<lambda>a. (isCNodeCap cap \<longrightarrow> True) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> ?Q12456 finala acap exposed final capa a) \<and> (\<not> isThreadCap cap \<longrightarrow> ?R12455 finala acap exposed final capa a))) and ?R12408 finala acap exposed final capa) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> {s. (isCNodeCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isCNodeCap cap \<longrightarrow> s \<in> {s. (isThreadCap cap \<longrightarrow> s \<in> ?S12459 finala acap exposed final capa v va vb) \<and> (\<not> isThreadCap cap \<longrightarrow> s \<in> ?T12457 finala acap exposed final capa v va vb)})})})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (6 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); \<not> isCNodeCap cap; \<not> isThreadCap cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R12455 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T12457 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) (IF isZombie cap THEN
  \<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
ELSE
  IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI
FI)
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv' t t'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_) (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv') [SKIP] (return (capability.NullCap, capability.NullCap)) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> \<lbrace>?R12408 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> return () \<lbrace>?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned)
 6. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ((\<lambda>a. (isCNodeCap cap \<longrightarrow> True) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> True) \<and> (\<not> isThreadCap cap \<longrightarrow> ?R12455 finala acap exposed final capa a))) and ?R12408 finala acap exposed final capa) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> {s. (isCNodeCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isCNodeCap cap \<longrightarrow> s \<in> {s. (isThreadCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isThreadCap cap \<longrightarrow> s \<in> ?T12457 finala acap exposed final capa v va vb)})})})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (7 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); \<not> isCNodeCap cap; \<not> isThreadCap cap; isZombie cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q12491 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?S12494 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) (\<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R12490 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T12492 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) (IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI)
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv' t t'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_) (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv') [SKIP] (return (capability.NullCap, capability.NullCap)) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> \<lbrace>?R12408 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> return () \<lbrace>?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 6. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned)
 7. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ((\<lambda>a. (isCNodeCap cap \<longrightarrow> True) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> True) \<and> (\<not> isThreadCap cap \<longrightarrow> (isZombie cap \<longrightarrow> ?Q12491 finala acap exposed final capa a) \<and> (\<not> isZombie cap \<longrightarrow> ?R12490 finala acap exposed final capa a)))) and ?R12408 finala acap exposed final capa) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> {s. (isCNodeCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isCNodeCap cap \<longrightarrow> s \<in> {s. (isThreadCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isThreadCap cap \<longrightarrow> s \<in> {s. (isZombie cap \<longrightarrow> s \<in> ?S12494 finala acap exposed final capa v va vb) \<and> (\<not> isZombie cap \<longrightarrow> s \<in> ?T12492 finala acap exposed final capa v va vb)})})})})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (7 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); \<not> isCNodeCap cap; \<not> isThreadCap cap; isZombie cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) UNIV [] (return ()) (\<acute>fc_ret :== remainder_C_update (\<lambda>_. capa) \<acute>fc_ret;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R12490 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T12492 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) (IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI)
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv' t t'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_) (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv') [SKIP] (return (capability.NullCap, capability.NullCap)) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> \<lbrace>?R12408 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> return () \<lbrace>?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 6. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned)
 7. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ((\<lambda>a. (isCNodeCap cap \<longrightarrow> True) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> True) \<and> (\<not> isThreadCap cap \<longrightarrow> (isZombie cap \<longrightarrow> True) \<and> (\<not> isZombie cap \<longrightarrow> ?R12490 finala acap exposed final capa a)))) and ?R12408 finala acap exposed final capa) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> {s. (isCNodeCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isCNodeCap cap \<longrightarrow> s \<in> {s. (isThreadCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isThreadCap cap \<longrightarrow> s \<in> {s. (isZombie cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cap \<longrightarrow> s \<in> ?T12492 finala acap exposed final capa v va vb)})})})})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (6 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R12490 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T12492 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) (IF isIRQHandlerCap cap THEN
  IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI
FI)
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv' t t'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_) (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv') [SKIP] (return (capability.NullCap, capability.NullCap)) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> \<lbrace>?R12408 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> return () \<lbrace>?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned)
 6. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ((\<lambda>a. (isCNodeCap cap \<longrightarrow> True) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> True) \<and> (\<not> isThreadCap cap \<longrightarrow> (isZombie cap \<longrightarrow> True) \<and> (\<not> isZombie cap \<longrightarrow> ?R12490 finala acap exposed final capa a)))) and ?R12408 finala acap exposed final capa) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> {s. (isCNodeCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isCNodeCap cap \<longrightarrow> s \<in> {s. (isThreadCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isThreadCap cap \<longrightarrow> s \<in> {s. (isZombie cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cap \<longrightarrow> s \<in> ?T12492 finala acap exposed final capa v va vb)})})})})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (7 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q12506 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?S12509 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) (IF finala THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(capa);;
\<acute>irq :== \<acute>ret__unsigned;;
CALL deletingIRQHandler_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. capa) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'
FI)
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; \<not> isIRQHandlerCap cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R12505 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T12507 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) SKIP
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv' t t'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_) (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv') [SKIP] (return (capability.NullCap, capability.NullCap)) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> \<lbrace>?R12408 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> return () \<lbrace>?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 6. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned)
 7. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ((\<lambda>a. (isCNodeCap cap \<longrightarrow> True) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> True) \<and> (\<not> isThreadCap cap \<longrightarrow> (isZombie cap \<longrightarrow> True) \<and> (\<not> isZombie cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> ?Q12506 finala acap exposed final capa a) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> ?R12505 finala acap exposed final capa a))))) and ?R12408 finala acap exposed final capa) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> {s. (isCNodeCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isCNodeCap cap \<longrightarrow> s \<in> {s. (isThreadCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isThreadCap cap \<longrightarrow> s \<in> {s. (isZombie cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cap \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<longrightarrow> s \<in> ?S12509 finala acap exposed final capa v va vb) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> s \<in> ?T12507 finala acap exposed final capa v va vb)})})})})})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (7 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = SCAST(32 signed \<rightarrow> 32) false; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> finala; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q12506 False acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) false) capa) (?S12509 False acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) false) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) SKIP
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; \<not> isIRQHandlerCap cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R12505 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T12507 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) SKIP
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv' t t'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_) (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv') [SKIP] (return (capability.NullCap, capability.NullCap)) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> \<lbrace>?R12408 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> return () \<lbrace>?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 6. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned)
 7. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ((\<lambda>a. (isCNodeCap cap \<longrightarrow> True) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> True) \<and> (\<not> isThreadCap cap \<longrightarrow> (isZombie cap \<longrightarrow> True) \<and> (\<not> isZombie cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> ?Q12506 finala acap exposed final capa a) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> ?R12505 finala acap exposed final capa a))))) and ?R12408 finala acap exposed final capa) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> {s. (isCNodeCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isCNodeCap cap \<longrightarrow> s \<in> {s. (isThreadCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isThreadCap cap \<longrightarrow> s \<in> {s. (isZombie cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cap \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<longrightarrow> s \<in> ?S12509 finala acap exposed final capa v va vb) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> s \<in> ?T12507 finala acap exposed final capa v va vb)})})})})})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (6 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; \<not> isIRQHandlerCap cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R12505 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T12507 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) SKIP
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv' t t'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_) (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv') [SKIP] (return (capability.NullCap, capability.NullCap)) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> \<lbrace>?R12408 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> return () \<lbrace>?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned)
 6. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ((\<lambda>a. (isCNodeCap cap \<longrightarrow> True) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> True) \<and> (\<not> isThreadCap cap \<longrightarrow> (isZombie cap \<longrightarrow> True) \<and> (\<not> isZombie cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> True) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> ?R12505 finala acap exposed final capa a))))) and ?R12408 finala acap exposed final capa) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> {s. (isCNodeCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isCNodeCap cap \<longrightarrow> s \<in> {s. (isThreadCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isThreadCap cap \<longrightarrow> s \<in> {s. (isZombie cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cap \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> s \<in> ?T12507 finala acap exposed final capa v va vb)})})})})})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (6 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; \<not> isIRQHandlerCap cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R12505 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa) (?T12507 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)) [] (return ()) SKIP
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv' t t'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_) (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv') [SKIP] (return (capability.NullCap, capability.NullCap)) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> \<lbrace>?R12408 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> return () \<lbrace>?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 5. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned)
 6. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ((\<lambda>a. (isCNodeCap cap \<longrightarrow> True) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> True) \<and> (\<not> isThreadCap cap \<longrightarrow> (isZombie cap \<longrightarrow> True) \<and> (\<not> isZombie cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> True) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> ?R12505 finala acap exposed final capa a))))) and ?R12408 finala acap exposed final capa) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> {s. (isCNodeCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isCNodeCap cap \<longrightarrow> s \<in> {s. (isThreadCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isThreadCap cap \<longrightarrow> s \<in> {s. (isZombie cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cap \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> s \<in> ?T12507 finala acap exposed final capa v va vb)})})})})})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (5 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv' t t'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_) (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv') [SKIP] (return (capability.NullCap, capability.NullCap)) (?d'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned rv')
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> \<lbrace>?R12408 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> return () \<lbrace>?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 4. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned)
 5. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ((\<lambda>a. (isCNodeCap cap \<longrightarrow> True) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> True) \<and> (\<not> isThreadCap cap \<longrightarrow> (isZombie cap \<longrightarrow> True) \<and> (\<not> isZombie cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> True) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> True))))) and ?R12408 finala acap exposed final capa) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> {s. (isCNodeCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isCNodeCap cap \<longrightarrow> s \<in> {s. (isThreadCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isThreadCap cap \<longrightarrow> s \<in> {s. (isZombie cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cap \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> s \<in> UNIV)})})})})})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (4 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_) (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv') [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> \<lbrace>?R12408 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> return () \<lbrace>?Q12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'12404 finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned)
 4. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ((\<lambda>a. (isCNodeCap cap \<longrightarrow> True) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> True) \<and> (\<not> isThreadCap cap \<longrightarrow> (isZombie cap \<longrightarrow> True) \<and> (\<not> isZombie cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> True) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> True))))) and ?R12408 finala acap exposed final capa) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> {s. (isCNodeCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isCNodeCap cap \<longrightarrow> s \<in> {s. (isThreadCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isThreadCap cap \<longrightarrow> s \<in> {s. (isZombie cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cap \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> s \<in> UNIV)})})})})})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (4 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); dc uu_ rv'\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.NullCap, capability.NullCap) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' s)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' s))}
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> \<lbrace>?R12408 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> return () \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>_ rv'. UNIV)
 4. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ((\<lambda>a. (isCNodeCap cap \<longrightarrow> True) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> True) \<and> (\<not> isThreadCap cap \<longrightarrow> (isZombie cap \<longrightarrow> True) \<and> (\<not> isZombie cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> True) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> True))))) and ?R12408 finala acap exposed final capa) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> {s. (isCNodeCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isCNodeCap cap \<longrightarrow> s \<in> {s. (isThreadCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isThreadCap cap \<longrightarrow> s \<in> {s. (isZombie cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cap \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> s \<in> UNIV)})})})})})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (4 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned uu_ rv' \<sigma>. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala); dc uu_ rv'\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>ta. cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return (capability.NullCap, capability.NullCap) \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' ta, fc_ret_' := finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' ta) (remainder_C_update (\<lambda>_. ret__struct_cap_C_' t) (fc_ret_' s)), ret__struct_finaliseCap_ret_C_' := finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' ta) (remainder_C_update (\<lambda>_. ret__struct_cap_C_' t) (fc_ret_' s)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation (fst rv) (remainder_C (finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' ta) (remainder_C_update (\<lambda>_. ret__struct_cap_C_' t) (fc_ret_' s)))) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' ta) (remainder_C_update (\<lambda>_. ret__struct_cap_C_' t) (fc_ret_' s))))))}
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> \<lbrace>?R12408 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> return () \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>_ rv'. UNIV)
 4. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ((\<lambda>a. (isCNodeCap cap \<longrightarrow> True) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> True) \<and> (\<not> isThreadCap cap \<longrightarrow> (isZombie cap \<longrightarrow> True) \<and> (\<not> isZombie cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> True) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> True))))) and ?R12408 finala acap exposed final capa) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> {s. (isCNodeCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isCNodeCap cap \<longrightarrow> s \<in> {s. (isThreadCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isThreadCap cap \<longrightarrow> s \<in> {s. (isZombie cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cap \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> s \<in> UNIV)})})})})})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (3 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> \<lbrace>?R12408 finala acap (SCAST(32 signed \<rightarrow> 32) false) (from_bool finala) capa\<rbrace> return () \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>_ rv'. UNIV)
 3. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ((\<lambda>a. (isCNodeCap cap \<longrightarrow> True) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> True) \<and> (\<not> isThreadCap cap \<longrightarrow> (isZombie cap \<longrightarrow> True) \<and> (\<not> isZombie cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> True) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> True))))) and ?R12408 finala acap exposed final capa) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> {s. (isCNodeCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isCNodeCap cap \<longrightarrow> s \<in> {s. (isThreadCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isThreadCap cap \<longrightarrow> s \<in> {s. (isZombie cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cap \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> s \<in> UNIV)})})})})})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (2 subgoals):
 1. \<And>finala acap exposed final capa ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = SCAST(32 signed \<rightarrow> 32) false; final = from_bool finala; ccap_relation cap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigneda = cap_get_tag capa; \<not> flag; ret__unsigned = cap_get_tag capa; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; \<not> (isIRQHandlerCap cap \<and> finala); \<not> (isZombie cap \<and> \<not> finala)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>_ rv'. UNIV)
 2. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ((\<lambda>a. (isCNodeCap cap \<longrightarrow> True) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> True) \<and> (\<not> isThreadCap cap \<longrightarrow> (isZombie cap \<longrightarrow> True) \<and> (\<not> isZombie cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> True) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> True))))) and (\<lambda>a. True)) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> {s. (isCNodeCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isCNodeCap cap \<longrightarrow> s \<in> {s. (isThreadCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isThreadCap cap \<longrightarrow> s \<in> {s. (isZombie cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cap \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> s \<in> UNIV)})})})})})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (1 subgoal):
 1. \<And>finala acap exposed final capa s s'. \<lbrakk>capAligned cap; \<not> isEndpointCap cap \<and> \<not> isNotificationCap cap \<and> \<not> isReplyCap cap \<and> cap \<noteq> capability.DomainCap \<and> cap \<noteq> capability.NullCap; 0 \<le>s - 1 \<or> acap = capCap cap; exposed = from_bool flag; final = from_bool finala; ccap_relation cap capa; (s, s') \<in> rf_sr; (invs' and sch_act_simple and valid_cap' cap and (\<lambda>s. ksIdleThread s \<notin> capRange cap) and (\<lambda>s. 2 ^ capBits cap \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap acap) and (\<lambda>s. 2 ^ acapBits acap \<le> gsMaxObjectSize s) and (\<lambda>a. True)) s)) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> (flag \<longrightarrow> True) \<and> (\<not> flag \<longrightarrow> (isCNodeCap cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>a. invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cap) a \<and> capTCBPtr cap \<noteq> ksIdleThread a \<and> True \<and> True)) s) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> finala \<longrightarrow> finala) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> (isIRQHandlerCap cap \<and> finala \<longrightarrow> (invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True) and (\<lambda>_. capIRQ cap \<le> local.maxIRQ)) s) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> (isZombie cap \<and> \<not> finala \<longrightarrow> True) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> ((\<lambda>a. (isCNodeCap cap \<longrightarrow> True) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> True) \<and> (\<not> isThreadCap cap \<longrightarrow> (isZombie cap \<longrightarrow> True) \<and> (\<not> isZombie cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> True) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> True))))) and (\<lambda>a. True)) s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. capa) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap acap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = final\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}) \<and> (\<not> isArchCap_tag (cap_get_tag capa) \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (flag \<longrightarrow> s \<in> UNIV) \<and> (\<not> flag \<longrightarrow> s \<in> {s. \<forall>vb. vb = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. (isCNodeCap cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isCNodeCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isThreadCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>v. tcb_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. cte_ptr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. cte_ptr_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_Ptr v) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. tcb_'_update (\<lambda>x. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}} \<inter> \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr v) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}) \<and> (\<not> (isThreadCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> finala) \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<and> finala \<longrightarrow> s \<in> {s. \<forall>vc v'. vc = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. vc) s \<in> {s. s \<in> {s. irq_'_update (\<lambda>x. vc) s \<in> UNIV \<inter> \<lbrace>irq_opt_relation (Some (capIRQ cap)) \<acute>irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12222 finala acap exposed final capa v va vb vc s t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>irq = UCAST(10 \<rightarrow> 32) (capIRQ cap)\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> (isIRQHandlerCap cap \<and> finala) \<longrightarrow> s \<in> {s. (isZombie cap \<and> \<not> finala \<longrightarrow> s \<in> UNIV) \<and> (\<not> (isZombie cap \<and> \<not> finala) \<longrightarrow> s \<in> {s. (isCNodeCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isCNodeCap cap \<longrightarrow> s \<in> {s. (isThreadCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isThreadCap cap \<longrightarrow> s \<in> {s. (isZombie cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cap \<longrightarrow> s \<in> {s. (isIRQHandlerCap cap \<longrightarrow> s \<in> UNIV) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> s \<in> UNIV)})})})})})})})})}})}})}}
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (1 subgoal):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (isArchCap (\<lambda>_. True) cap \<longrightarrow> \<not> flag \<longrightarrow> valid_cap' (capability.ArchObjectCap (capCap cap)) s \<and> 2 ^ acapBits (capCap cap) \<le> gsMaxObjectSize s) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> \<not> flag \<longrightarrow> (isCNodeCap cap \<longrightarrow> \<not> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> tcb_at' (capTCBPtr cap) s \<and> capTCBPtr cap \<noteq> ksIdleThread s) \<and> ((isThreadCap cap \<longrightarrow> \<not> finala) \<longrightarrow> (isZombie cap \<longrightarrow> \<not> finala) \<longrightarrow> isIRQHandlerCap cap \<and> finala \<longrightarrow> weak_sch_act_wf (ksSchedulerAction s) s \<and> capIRQ cap \<le> local.maxIRQ)) \<and> (isArchCap (\<lambda>_. True) cap \<longrightarrow> \<not> flag \<longrightarrow> ccap_relation (capability.ArchObjectCap (capCap cap)) capa) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> \<not> flag \<longrightarrow> (isCNodeCap cap \<longrightarrow> \<not> finala) \<longrightarrow> (isThreadCap cap \<and> finala \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cap) \<and> ptr_add_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd (t_hrs_' (globals s')))) \<and> ((isThreadCap cap \<longrightarrow> \<not> finala) \<longrightarrow> (isZombie cap \<longrightarrow> \<not> finala) \<longrightarrow> isIRQHandlerCap cap \<and> finala \<longrightarrow> irq_opt_relation (Some (capIRQ cap)) (capIRQ_CL (cap_irq_handler_cap_lift capa)) \<and> (\<forall>t. s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr> \<in> ?Q'12222 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t ()) \<and> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)))
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (12 subgoals):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; isArchCap (\<lambda>_. True) cap; \<not> flag\<rbrakk> \<Longrightarrow> valid_cap' (capability.ArchObjectCap (capCap cap)) s
 2. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; isArchCap (\<lambda>_. True) cap; \<not> flag\<rbrakk> \<Longrightarrow> 2 ^ acapBits (capCap cap) \<le> gsMaxObjectSize s
 3. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> tcb_at' (capTCBPtr cap) s
 4. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> capTCBPtr cap \<noteq> ksIdleThread s
 5. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> weak_sch_act_wf (ksSchedulerAction s) s
 6. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ cap \<le> local.maxIRQ
 7. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; isArchCap (\<lambda>_. True) cap; \<not> flag\<rbrakk> \<Longrightarrow> ccap_relation (capability.ArchObjectCap (capCap cap)) capa
 8. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)
 9. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> ptr_add_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd (t_hrs_' (globals s')))
 10. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> irq_opt_relation (Some (capIRQ cap)) (capIRQ_CL (cap_irq_handler_cap_lift capa))
A total of 12 subgoals...
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (11 subgoals):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; isArchCap (\<lambda>_. True) cap; \<not> flag\<rbrakk> \<Longrightarrow> 2 ^ acapBits (capCap cap) \<le> gsMaxObjectSize s
 2. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> tcb_at' (capTCBPtr cap) s
 3. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> capTCBPtr cap \<noteq> ksIdleThread s
 4. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> weak_sch_act_wf (ksSchedulerAction s) s
 5. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ cap \<le> local.maxIRQ
 6. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; isArchCap (\<lambda>_. True) cap; \<not> flag\<rbrakk> \<Longrightarrow> ccap_relation (capability.ArchObjectCap (capCap cap)) capa
 7. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)
 8. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> ptr_add_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd (t_hrs_' (globals s')))
 9. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> irq_opt_relation (Some (capIRQ cap)) (capIRQ_CL (cap_irq_handler_cap_lift capa))
 10. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>t. s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr> \<in> ?Q'12222 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t ()
A total of 11 subgoals...
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (10 subgoals):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> tcb_at' (capTCBPtr cap) s
 2. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> capTCBPtr cap \<noteq> ksIdleThread s
 3. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> weak_sch_act_wf (ksSchedulerAction s) s
 4. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ cap \<le> local.maxIRQ
 5. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; isArchCap (\<lambda>_. True) cap; \<not> flag\<rbrakk> \<Longrightarrow> ccap_relation (capability.ArchObjectCap (capCap cap)) capa
 6. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)
 7. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> ptr_add_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd (t_hrs_' (globals s')))
 8. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> irq_opt_relation (Some (capIRQ cap)) (capIRQ_CL (cap_irq_handler_cap_lift capa))
 9. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>t. s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr> \<in> ?Q'12222 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t ()
 10. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (9 subgoals):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> capTCBPtr cap \<noteq> ksIdleThread s
 2. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> weak_sch_act_wf (ksSchedulerAction s) s
 3. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ cap \<le> local.maxIRQ
 4. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; isArchCap (\<lambda>_. True) cap; \<not> flag\<rbrakk> \<Longrightarrow> ccap_relation (capability.ArchObjectCap (capCap cap)) capa
 5. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)
 6. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> ptr_add_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd (t_hrs_' (globals s')))
 7. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> irq_opt_relation (Some (capIRQ cap)) (capIRQ_CL (cap_irq_handler_cap_lift capa))
 8. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>t. s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr> \<in> ?Q'12222 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t ()
 9. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (8 subgoals):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> weak_sch_act_wf (ksSchedulerAction s) s
 2. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ cap \<le> local.maxIRQ
 3. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; isArchCap (\<lambda>_. True) cap; \<not> flag\<rbrakk> \<Longrightarrow> ccap_relation (capability.ArchObjectCap (capCap cap)) capa
 4. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)
 5. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> ptr_add_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd (t_hrs_' (globals s')))
 6. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> irq_opt_relation (Some (capIRQ cap)) (capIRQ_CL (cap_irq_handler_cap_lift capa))
 7. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>t. s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr> \<in> ?Q'12222 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t ()
 8. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (7 subgoals):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ cap \<le> local.maxIRQ
 2. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; isArchCap (\<lambda>_. True) cap; \<not> flag\<rbrakk> \<Longrightarrow> ccap_relation (capability.ArchObjectCap (capCap cap)) capa
 3. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)
 4. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> ptr_add_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd (t_hrs_' (globals s')))
 5. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> irq_opt_relation (Some (capIRQ cap)) (capIRQ_CL (cap_irq_handler_cap_lift capa))
 6. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>t. s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr> \<in> ?Q'12222 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t ()
 7. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (6 subgoals):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; isArchCap (\<lambda>_. True) cap; \<not> flag\<rbrakk> \<Longrightarrow> ccap_relation (capability.ArchObjectCap (capCap cap)) capa
 2. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)
 3. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> ptr_add_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd (t_hrs_' (globals s')))
 4. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> irq_opt_relation (Some (capIRQ cap)) (capIRQ_CL (cap_irq_handler_cap_lift capa))
 5. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>t. s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr> \<in> ?Q'12222 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t ()
 6. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (5 subgoals):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cap)
 2. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> ptr_add_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd (t_hrs_' (globals s')))
 3. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> irq_opt_relation (Some (capIRQ cap)) (capIRQ_CL (cap_irq_handler_cap_lift capa))
 4. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>t. s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr> \<in> ?Q'12222 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t ()
 5. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (5 subgoals):
 1. \<And>finala capa s s' v0. \<lbrakk>capAligned (capability.ThreadCap v0); ccap_relation (capability.ThreadCap v0) capa; (s, s') \<in> rf_sr; invs' s; sch_act_simple s; tcb_at' v0 s; ksIdleThread s \<notin> capRange (capability.ThreadCap v0); 2 ^ objBits undefined \<le> gsMaxObjectSize s; \<not> flag; finala; cap = capability.ThreadCap v0\<rbrakk> \<Longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa)) = tcb_ptr_to_ctcb_ptr v0
 2. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> ptr_add_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd (t_hrs_' (globals s')))
 3. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> irq_opt_relation (Some (capIRQ cap)) (capIRQ_CL (cap_irq_handler_cap_lift capa))
 4. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>t. s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr> \<in> ?Q'12222 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t ()
 5. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (4 subgoals):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<and> finala\<rbrakk> \<Longrightarrow> ptr_add_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd (t_hrs_' (globals s')))
 2. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> irq_opt_relation (Some (capIRQ cap)) (capIRQ_CL (cap_irq_handler_cap_lift capa))
 3. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>t. s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr> \<in> ?Q'12222 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t ()
 4. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (4 subgoals):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; isThreadCap cap; finala\<rbrakk> \<Longrightarrow> ptr_add_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd (t_hrs_' (globals s')))
 2. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> irq_opt_relation (Some (capIRQ cap)) (capIRQ_CL (cap_irq_handler_cap_lift capa))
 3. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>t. s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr> \<in> ?Q'12222 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t ()
 4. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (4 subgoals):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; isThreadCap cap; finala; cap = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa))))\<rbrakk> \<Longrightarrow> ptr_add_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd (t_hrs_' (globals s')))
 2. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> irq_opt_relation (Some (capIRQ cap)) (capIRQ_CL (cap_irq_handler_cap_lift capa))
 3. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>t. s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr> \<in> ?Q'12222 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t ()
 4. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (4 subgoals):
 1. \<And>finala capa s s'. \<lbrakk>capAligned (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa))))); ccap_relation (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa))))) capa; (s, s') \<in> rf_sr; invs' s; sch_act_simple s; valid_cap' (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa))))) s; ksIdleThread s \<notin> capRange (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa))))); 2 ^ objBits undefined \<le> gsMaxObjectSize s; \<not> flag; finala; cap = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa))))\<rbrakk> \<Longrightarrow> ptr_add_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift capa) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd (t_hrs_' (globals s')))
 2. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> irq_opt_relation (Some (capIRQ cap)) (capIRQ_CL (cap_irq_handler_cap_lift capa))
 3. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>t. s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr> \<in> ?Q'12222 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t ()
 4. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (3 subgoals):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> irq_opt_relation (Some (capIRQ cap)) (capIRQ_CL (cap_irq_handler_cap_lift capa))
 2. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>t. s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr> \<in> ?Q'12222 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t ()
 3. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (3 subgoals):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap; finala\<rbrakk> \<Longrightarrow> irq_opt_relation (Some (capIRQ cap)) (capIRQ_CL (cap_irq_handler_cap_lift capa))
 2. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>t. s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr> \<in> ?Q'12222 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t ()
 3. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (3 subgoals):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap; finala; cap = capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift capa)))\<rbrakk> \<Longrightarrow> irq_opt_relation (Some (capIRQ cap)) (capIRQ_CL (cap_irq_handler_cap_lift capa))
 2. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>t. s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr> \<in> ?Q'12222 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t ()
 3. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (3 subgoals):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap; finala; cap = capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift capa))); capIRQ_CL (cap_irq_handler_cap_lift capa) && mask 10 = capIRQ_CL (cap_irq_handler_cap_lift capa)\<rbrakk> \<Longrightarrow> irq_opt_relation (Some (capIRQ cap)) (capIRQ_CL (cap_irq_handler_cap_lift capa))
 2. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>t. s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr> \<in> ?Q'12222 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t ()
 3. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (3 subgoals):
 1. \<And>finala capa s s'. \<lbrakk>capAligned (capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift capa)))); ccap_relation (capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift capa)))) capa; (s, s') \<in> rf_sr; invs' s; sch_act_simple s; UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift capa)) \<le> 0x9F; ksIdleThread s \<notin> capRange (capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift capa)))); Suc 0 \<le> gsMaxObjectSize s; \<not> flag; finala; cap = capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift capa))); capIRQ_CL (cap_irq_handler_cap_lift capa) && mask 10 = capIRQ_CL (cap_irq_handler_cap_lift capa)\<rbrakk> \<Longrightarrow> irq_opt_relation (Some (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift capa)))) (capIRQ_CL (cap_irq_handler_cap_lift capa))
 2. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>t. s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr> \<in> ?Q'12222 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t ()
 3. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (3 subgoals):
 1. \<And>finala capa s s'. \<lbrakk>capAligned (capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift capa)))); ccap_relation (capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift capa)))) capa; (s, s') \<in> rf_sr; invs' s; sch_act_simple s; UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift capa)) \<le> 0x9F; ksIdleThread s \<notin> capRange (capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift capa)))); Suc 0 \<le> gsMaxObjectSize s; \<not> flag; finala; cap = capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift capa))); capIRQ_CL (cap_irq_handler_cap_lift capa) && mask 10 = capIRQ_CL (cap_irq_handler_cap_lift capa)\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift capa)) \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<or> capIRQ_CL (cap_irq_handler_cap_lift capa) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ
 2. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>t. s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr> \<in> ?Q'12222 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t ()
 3. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (2 subgoals):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> \<forall>t. s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr> \<in> ?Q'12222 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t ()
 2. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa. ?Q'12222 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) \<equiv>\<^sup>? \<lambda>acap capa ret__unsigned s t rv. ?Q'12221 acap capa ret__unsigned (irq_' s) rv (xfdc t) proof (prove)
goal (1 subgoal):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; isCNodeCap cap \<longrightarrow> \<not> finala; isThreadCap cap \<longrightarrow> \<not> finala; isZombie cap \<longrightarrow> \<not> finala; isIRQHandlerCap cap \<and> finala\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa ret__unsigned s t rv. ?y12854 acap capa ret__unsigned (irq_' s) rv (xfdc t) \<equiv>\<^sup>? \<lambda>acap capa. ?y12853 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)
?y12855 True \<equiv>\<^sup>? \<lambda>capa s' t. ?y12853 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t () (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap; finala\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa ret__unsigned s t rv. ?y12854 acap capa ret__unsigned (irq_' s) rv (xfdc t) \<equiv>\<^sup>? \<lambda>acap capa. ?y12853 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)
?y12855 True \<equiv>\<^sup>? \<lambda>capa s' t. ?y12853 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t () (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap; finala; cap = capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift capa)))\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa ret__unsigned s t rv. ?y12854 acap capa ret__unsigned (irq_' s) rv (xfdc t) \<equiv>\<^sup>? \<lambda>acap capa. ?y12853 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)
?y12855 True \<equiv>\<^sup>? \<lambda>capa s' t. ?y12853 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t () (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>finala capa s s'. \<lbrakk>capAligned cap; ccap_relation cap capa; (s, s') \<in> rf_sr; \<not> isEndpointCap cap; invs' s; \<not> isNotificationCap cap; sch_act_simple s; \<not> isReplyCap cap; valid_cap' cap s; cap \<noteq> capability.DomainCap; cap \<noteq> capability.NullCap; ksIdleThread s \<notin> capRange cap; 2 ^ capBits cap \<le> gsMaxObjectSize s; \<not> isArchCap (\<lambda>_. True) cap; \<not> flag; \<not> isCNodeCap cap; \<not> isThreadCap cap; \<not> isZombie cap; isIRQHandlerCap cap; finala; cap = capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift capa))); capIRQ_CL (cap_irq_handler_cap_lift capa) && mask 10 = capIRQ_CL (cap_irq_handler_cap_lift capa)\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift capa) = UCAST(10 \<rightarrow> 32) (capIRQ cap)
flex-flex pairs:
\<lambda>acap capa ret__unsigned s t rv. ?y12854 acap capa ret__unsigned (irq_' s) rv (xfdc t) \<equiv>\<^sup>? \<lambda>acap capa. ?y12853 True acap (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa)
?y12855 True \<equiv>\<^sup>? \<lambda>capa s' t. ?y12853 True (capCap cap) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) true) capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa) (cap_get_tag capa) (capIRQ_CL (cap_irq_handler_cap_lift capa)) (irq_'_update (\<lambda>_. capIRQ_CL (cap_irq_handler_cap_lift capa)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa)\<rparr>)) t () (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capIRQ_CL (cap_irq_handler_cap_lift capa), irq_' := capIRQ_CL (cap_irq_handler_cap_lift capa), globals := globals t\<rparr>)