theory Delete_C

lemma finaliseSlot_ccorres:
  notes from_bool_neq_0 [simp del]
  shows
  "ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt))
     (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (success_C v, finaliseSlot_ret_C.cleanupInfo_C v))
                   ret__struct_finaliseSlot_ret_C_')
     (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (exposed \<or> ex_cte_cap_to' slot s))
     (UNIV \<inter> {s. slot_' s = Ptr slot} \<inter> {s. immediate_' s = from_bool exposed}) []
     (cutMon ((=) s) (finaliseSlot slot exposed)) (Call finaliseSlot_'proc)" apply (rule finaliseSlot_ccorres_induction_helper) apply (induct rule: finaliseSlot'.induct[where ?a0.0=slot and ?a1.0=exposed and ?a2.0=s]) subgoal premises hyps for slot' expo s' apply (subst finaliseSlot'.simps) apply (fold cteDelete_def[unfolded finaliseSlot_def]) apply (fold reduceZombie_def) apply (simp only: liftE_bindE cutMon_walk_bind
                      withoutPreemption_def fun_app_def) apply (rule ccorres_drop_cutMon_bind) apply (rule ccorres_symb_exec_l'
                   [OF _ getCTE_inv getCTE_sp empty_fail_getCTE]) apply (rule ccorres_guard_imp2) apply (rule ccorres_move_c_guard_cte) apply (rule ccorres_cutMon, simp only: cutMon_walk_if) apply (rule ccorres_symb_exec_r) apply (rule iffD1 [OF ccorres_expand_while_iff_Seq]) apply (rule_tac xf'=ret__unsigned_' in ccorres_abstract) apply ceqv apply (rule_tac P="(rv' = scast cap_null_cap) = (cteCap rv = NullCap)"
                    in ccorres_gen_asm2) apply (rule ccorres_if_lhs) apply (simp del: Collect_const add: Collect_True Collect_False
                                            ccorres_cond_iffs) apply (rule ccorres_drop_cutMon) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: returnOk_def return_def ccap_relation_NullCap_iff) apply (simp add: Collect_True liftE_bindE split_def
                        ccorres_cond_iffs cutMon_walk_bind
                   del: Collect_const cong: call_ignore_cong) apply (rule ccorres_drop_cutMon_bind) apply (clarsimp simp only: from_bool_0) apply (rule ccorres_rhs_assoc)+ apply (ctac(no_vcg) add: isFinalCapability_ccorres[where slot=slot']) apply (rule ccorres_cutMon, simp only: cutMon_walk_bind) apply (rule ccorres_drop_cutMon_bind) apply (rule ccorres_move_c_guard_cte) apply (rule_tac A="\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s
                                \<and> (expo \<or> ex_cte_cap_to' slot' s)
                                \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))"
                    and A'=UNIV
                     in ccorres_guard_imp2) apply (ctac(no_vcg) add: finaliseCap_ccorres) apply (rule ccorres_add_return) apply (rule_tac r'="\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')"
                     and xf'=ret__unsigned_long_' in ccorres_split_nothrow_novcg) apply (rule_tac P="\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = NullCap)"
                           in ccorres_from_vcg[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply auto[1] apply ceqv apply (rule ccorres_cutMon) apply (simp add: cutMon_walk_if from_bool_0
                        del: Collect_const
                       cong: call_ignore_cong) apply (rule ccorres_if_lhs) apply simp apply (rule ccorres_drop_cutMon,
                    rule ccorres_split_throws) apply (rule_tac P="\<lambda>s. case (snd rvb) of
                                        IRQHandlerCap irq \<Rightarrow> UCAST(10\<rightarrow>machine_word_len) irq \<le> SCAST(32 signed\<rightarrow>machine_word_len) Kernel_C.maxIRQ
                                      | _ \<Rightarrow> True"
                              in ccorres_from_vcg_throws[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: returnOk_def return_def) apply (clarsimp simp: cleanup_info_wf'_def arch_cleanup_info_wf'_def
                             split: if_split capability.splits) apply vcg apply (simp only: cutMon_walk_if Collect_False ccorres_seq_cond_empty
                              ccorres_seq_skip) apply (rule ccorres_move_c_guard_cte) apply (rule ccorres_if_lhs) apply (simp only: cutMon_walk_bind withoutPreemption_def
                               liftE_bindE fun_app_def) apply (rule ccorres_drop_cutMon_bind,
                    rule_tac r'=dc and xf'=xfdc in ccorres_split_nothrow_novcg) apply (rule ccorres_guard_imp2[where A=\<top> and A'=UNIV]) apply (rule ccorres_updateCap) apply clarsimp apply (rule ceqv_refl) apply csymbr apply (simp only: if_1_0_0 simp_thms Collect_True
                                 ccorres_seq_cond_univ) apply (rule ccorres_rhs_assoc)+ apply (rule ccorres_add_return,
                      rule_tac r'="\<lambda>rv rv'. rv' = from_bool True"
                          and xf'=ret__unsigned_long_' in ccorres_split_nothrow_novcg) apply (rule_tac P="\<lambda>s. capAligned (fst rvb)"
                               in ccorres_from_vcg[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply (auto simp: isCap_simps capCyclicZombie_def)[1] apply ceqv apply csymbr apply (simp add: from_bool_0) apply (rule ccorres_split_throws) apply (rule ccorres_drop_cutMon,
                         rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: returnOk_def return_def) apply (drule use_valid [OF _ finaliseCap_cases, OF _ TrueI]) apply (simp add: irq_opt_relation_def
                            split: if_split_asm) apply vcg apply wp apply (simp add: guard_is_UNIV_def) apply wp apply (simp add: guard_is_UNIV_def) apply (simp only: liftE_bindE cutMon_walk_bind Let_def
                              withoutPreemption_def fun_app_def
                              split_def K_bind_def fst_conv snd_conv) apply (rule ccorres_drop_cutMon_bind,
                   rule_tac r'=dc and xf'=xfdc in ccorres_split_nothrow_novcg) apply (rule ccorres_guard_imp2[where A=\<top> and A'=UNIV]) apply (rule ccorres_updateCap) apply clarsimp apply (rule ceqv_refl) apply (subgoal_tac "isZombie (fst rvb)") prefer 2 apply (drule use_valid [OF _ finaliseCap_cases, OF _ TrueI]) apply (auto simp add: capRemovable_def)[1] apply (rule ccorres_cutMon, simp only: cutMon_walk_bindE cutMon_walk_if) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_add_return,
                     rule_tac r'="\<lambda>rv rv'. rv' = from_bool False"
                         and xf'=ret__int_' in ccorres_split_nothrow_novcg) apply (rule_tac P="\<lambda>s. capAligned (fst rvb)"
                               in ccorres_from_vcg[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply fastforce apply ceqv apply (simp only: from_bool_0 simp_thms Collect_False
                                  ccorres_seq_cond_empty ccorres_seq_skip) apply (ctac (no_vcg, no_simp) add: reduceZombie_ccorres1) apply (rule ccorres_guard_imp2) apply (rule finaliseSlot_ccorres_induction_helper) apply (rule hyps(1), (simp add: in_monad | rule conjI refl)+)[1] apply simp apply assumption apply (rule ccorres_cutMon) apply (simp only: cutMon_walk_bindE id_apply simp_thms
                                    Collect_False ccorres_seq_cond_empty
                                    ccorres_seq_skip) apply (rule ccorres_drop_cutMon_bindE) apply (ctac(no_vcg) add: preemptionPoint_ccorres) apply (rule ccorres_cutMon) apply (simp only: id_apply simp_thms
                                      Collect_False ccorres_seq_cond_empty
                                      ccorres_seq_skip) apply (rule rsubst[where P="ccorres r xf' P P' hs a" for r xf' P P' hs a]) apply (rule hyps[folded reduceZombie_def[unfolded cteDelete_def finaliseSlot_def],
                                     unfolded split_def],
                           (simp add: in_monad)+) apply (simp add: from_bool_0) apply simp apply (rule ccorres_split_throws) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def cintr_def) apply vcg apply (wp preemptionPoint_invR) apply simp apply simp apply (rule ccorres_split_throws) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def cintr_def) apply vcg apply (wp cutMon_validE_drop reduceZombie_invs reduceZombie_sch_act_simple) apply (wp reduceZombie_cap_to[simplified imp_conv_disj, simplified])+ apply (simp add: guard_is_UNIV_def) apply (simp add: conj_comms) apply (wp make_zombie_invs' updateCap_cte_wp_at_cases
                        updateCap_cap_to' hoare_vcg_disj_lift hoare_weak_lift_imp)+ apply (simp add: guard_is_UNIV_def) apply wp apply (simp add: guard_is_UNIV_def) apply (rule hoare_strengthen_post) apply (rule_tac Q="\<lambda>fin s. invs' s \<and> sch_act_simple s \<and> s \<turnstile>' (fst fin)
                                   \<and> (expo \<or> ex_cte_cap_to' slot' s)
                                   \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' s"
                     in hoare_vcg_conj_lift) apply (wp hoare_vcg_disj_lift finaliseCap_invs[where sl=slot'])[1] apply (rule hoare_vcg_conj_lift) apply (rule finaliseCap_cte_refs) apply (rule finaliseCap_replaceable[where slot=slot']) apply (clarsimp simp: cte_wp_at_ctes_of) apply (erule disjE[where P="F \<and> G" for F G]) apply (clarsimp simp: capRemovable_def cte_wp_at_ctes_of cap_has_cleanup'_def
                         split: option.split capability.splits) apply (auto dest!: ctes_of_valid'
                       simp: valid_cap'_def Kernel_C.maxIRQ_def ARM.maxIRQ_def
                             unat_ucast word_le_nat_alt)[1] apply (clarsimp dest!: isCapDs) subgoal by (auto dest!: valid_capAligned ctes_of_valid'
                      simp: isCap_simps final_matters'_def o_def) apply clarsimp apply (frule valid_globals_cte_wpD'[rotated], clarsimp) apply (clarsimp simp: cte_wp_at_ctes_of) apply (erule(1) cmap_relationE1 [OF cmap_relation_cte]) apply (frule valid_global_refsD_with_objSize, clarsimp) apply (auto simp: typ_heap_simps dest!: ccte_relation_ccap_relation)[1] apply (wp isFinalCapability_inv hoare_weak_lift_imp | wp (once) isFinal[where x=slot'])+ apply vcg apply (rule conseqPre, vcg) apply clarsimp apply (clarsimp simp: cte_wp_at_ctes_of) apply (rule conjI, (auto)[1]) apply clarsimp apply (erule(1) cmap_relationE1 [OF cmap_relation_cte]) apply (clarsimp simp: typ_heap_simps cap_get_tag_isCap
                   dest!: ccte_relation_ccap_relation) done done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot s)) (UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool exposed\<rbrace>) [] (cutMon ((=) s) (finaliseSlot slot exposed)) (Call finaliseSlot_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot s)) UNIV [SKIP] (cutMon ((=) s) (finaliseSlot' slot exposed)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool exposed \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot,from_bool exposed);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))) proof (prove)
goal (1 subgoal):
 1. \<And>x b s. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc xa xb y xaa xab xac v sa s'. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); xa = (fst rvb, b); (xb, y) = xa; \<not> (isZombie xb \<and> capZombieNumber xb = 0); \<not> (isZombie xb \<and> \<not> y); isZombie xb \<and> y; xaa = xb; xab = capZombiePtr xaa; xac = capZombieNumber xaa; (Inr v, s') \<in> fst ((withoutPreemption $ locateSlotCap xaa (fromIntegral (xac - 1))) sa)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a. case a of (success, irqopt) \<Rightarrow> \<lambda>a. case a of (success', irq') \<Rightarrow> success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) v s)) UNIV [SKIP] (cutMon ((=) s') (finaliseSlot' v False)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr v} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr v\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr v);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr v} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr v\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr v);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr v} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr v\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool False \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr v);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr v,from_bool False);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr v} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr v\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))); \<And>rv st rva sta rvb stb rvc stc rvd std rve ste. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); (Inr rvd, std) \<in> fst ((let (v33, v34) = (fst rvb, b) in if isZombie v33 \<and> capZombieNumber v33 = 0 then haskell_fail [] else if isZombie v33 \<and> \<not> v34 then let ptr = capZombiePtr v33 in doE haskell_assertE (ptr \<noteq> x) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr x
odE else if isZombie v33 \<and> v34 then let z = v33; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE (success, info) <- finaliseSlot' endSlot False;
whenE (False \<or> success) $ withoutPreemption $ emptySlot endSlot info
odE;
ourCTE <- withoutPreemption $ getCTE x;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap x
od else haskell_assertE (ptr2 = x \<and> ptr \<noteq> x) [] else haskell_fail []
odE else haskell_fail []) stc); (Inr rve, ste) \<in> fst (preemptionPoint std)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a. case a of (success, irqopt) \<Rightarrow> \<lambda>a. case a of (success', irq') \<Rightarrow> success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (b \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x s)) UNIV [SKIP] (cutMon ((=) ste) (finaliseSlot' x b)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr x} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr x\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr x);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr x} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr x\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr x);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr x} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr x\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool b \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr x);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr x,from_bool b);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr x} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr x\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a. case a of (success, irqopt) \<Rightarrow> \<lambda>a. case a of (success', irq') \<Rightarrow> success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (b \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x s)) UNIV [SKIP] (cutMon ((=) s) (finaliseSlot' x b)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr x} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr x\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr x);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr x} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr x\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr x);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr x} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr x\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool b \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr x);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr x,from_bool b);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr x} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr x\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))) proof (prove)
goal (1 subgoal):
 1. ccorres (cintr \<currency> (\<lambda>a. case a of (success, irqopt) \<Rightarrow> \<lambda>a. case a of (success', irq') \<Rightarrow> success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s)) UNIV [SKIP] (cutMon ((=) s') (finaliseSlot' slot' expo)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))) proof (prove)
goal (1 subgoal):
 1. ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s)) UNIV [SKIP] (cutMon ((=) s') (doE cte <- withoutPreemption $ getCTE slot';
if isNullCap $ cteCap cte then returnOk (True, capability.NullCap) else doE final <- withoutPreemption $ isFinalCapability cte;
(remainder, info) <- withoutPreemption $ global.finaliseCap (cteCap cte) final False;
if capRemovable remainder slot' then returnOk (True, info) else if \<not> expo \<and> capCyclicZombie remainder slot' then doE withoutPreemption $ updateCap slot' remainder;
returnOk (False, capability.NullCap)
odE else doE withoutPreemption $ updateCap slot' remainder;
let (v33, v34) = (remainder, expo) in if isZombie v33 \<and> capZombieNumber v33 = 0 then haskell_fail [] else if isZombie v33 \<and> \<not> v34 then let ptr = capZombiePtr v33 in doE haskell_assertE (ptr \<noteq> slot') [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr slot'
odE else if isZombie v33 \<and> v34 then let z = v33; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE (success, info) <- finaliseSlot' endSlot False;
whenE (False \<or> success) $ withoutPreemption $ emptySlot endSlot info
odE;
ourCTE <- withoutPreemption $ getCTE slot';
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot'
od else haskell_assertE (ptr2 = slot' \<and> ptr \<noteq> slot') [] else haskell_fail []
odE else haskell_fail [];
preemptionPoint;
finaliseSlot' slot' expo
odE
odE
odE)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))) proof (prove)
goal (1 subgoal):
 1. ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s)) UNIV [SKIP] (cutMon ((=) s') (doE cte <- withoutPreemption $ getCTE slot';
if isNullCap $ cteCap cte then returnOk (True, capability.NullCap) else doE final <- withoutPreemption $ isFinalCapability cte;
(remainder, info) <- withoutPreemption $ global.finaliseCap (cteCap cte) final False;
if capRemovable remainder slot' then returnOk (True, info) else if \<not> expo \<and> capCyclicZombie remainder slot' then doE withoutPreemption $ updateCap slot' remainder;
returnOk (False, capability.NullCap)
odE else doE withoutPreemption $ updateCap slot' remainder;
let (v33, v34) = (remainder, expo) in if isZombie v33 \<and> capZombieNumber v33 = 0 then haskell_fail [] else if isZombie v33 \<and> \<not> v34 then let ptr = capZombiePtr v33 in doE haskell_assertE (ptr \<noteq> slot') [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr slot'
odE else if isZombie v33 \<and> v34 then let z = v33; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot';
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot'
od else haskell_assertE (ptr2 = slot' \<and> ptr \<noteq> slot') [] else haskell_fail []
odE else haskell_fail [];
preemptionPoint;
finaliseSlot' slot' expo
odE
odE
odE)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))) proof (prove)
goal (1 subgoal):
 1. ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s)) UNIV [SKIP] (cutMon ((=) s') (doE cte <- withoutPreemption $ getCTE slot';
if isNullCap $ cteCap cte then returnOk (True, capability.NullCap) else doE final <- withoutPreemption $ isFinalCapability cte;
(remainder, info) <- withoutPreemption $ global.finaliseCap (cteCap cte) final False;
if capRemovable remainder slot' then returnOk (True, info) else if \<not> expo \<and> capCyclicZombie remainder slot' then doE withoutPreemption $ updateCap slot' remainder;
returnOk (False, capability.NullCap)
odE else doE withoutPreemption $ updateCap slot' remainder;
reduceZombie remainder slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
odE
odE)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))) proof (prove)
goal (1 subgoal):
 1. ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s)) UNIV [SKIP] (do rv <- cutMon ((=) s') (getCTE slot');
cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (if isNullCap (cteCap rv) then returnOk (True, capability.NullCap) else do final <- isFinalCapability rv;
(remainder, info) <- global.finaliseCap (cteCap rv) final False;
if capRemovable remainder slot' then returnOk (True, info) else if \<not> expo \<and> capCyclicZombie remainder slot' then do updateCap slot' remainder;
returnOk (False, capability.NullCap)
od else do updateCap slot' remainder;
doE reduceZombie remainder slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))) proof (prove)
goal (1 subgoal):
 1. ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s)) UNIV [SKIP] (do rv <- getCTE slot';
cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (if isNullCap (cteCap rv) then returnOk (True, capability.NullCap) else do final <- isFinalCapability rv;
(remainder, info) <- global.finaliseCap (cteCap rv) final False;
if capRemovable remainder slot' then returnOk (True, info) else if \<not> expo \<and> capCyclicZombie remainder slot' then do updateCap slot' remainder;
returnOk (False, capability.NullCap)
od else do updateCap slot' remainder;
doE reduceZombie remainder slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))) proof (prove)
goal (1 subgoal):
 1. \<And>rv. ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) UNIV [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (if isNullCap (cteCap rv) then returnOk (True, capability.NullCap) else do final <- isFinalCapability rv;
(remainder, info) <- global.finaliseCap (cteCap rv) final False;
if capRemovable remainder slot' then returnOk (True, info) else if \<not> expo \<and> capCyclicZombie remainder slot' then do updateCap slot' remainder;
returnOk (False, capability.NullCap)
od else do updateCap slot' remainder;
doE reduceZombie remainder slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))) proof (prove)
goal (2 subgoals):
 1. \<And>rv. ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q8 rv) (?Q'8 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (if isNullCap (cteCap rv) then returnOk (True, capability.NullCap) else do final <- isFinalCapability rv;
(remainder, info) <- global.finaliseCap (cteCap rv) final False;
if capRemovable remainder slot' then returnOk (True, info) else if \<not> expo \<and> capCyclicZombie remainder slot' then do updateCap slot' remainder;
returnOk (False, capability.NullCap)
od else do updateCap slot' remainder;
doE reduceZombie remainder slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))
 2. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q8 rv s \<and> s' \<in> ?Q'8 rv proof (prove)
goal (2 subgoals):
 1. \<And>rv. ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?A11 rv) (?C'11 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (if isNullCap (cteCap rv) then returnOk (True, capability.NullCap) else do final <- isFinalCapability rv;
(remainder, info) <- global.finaliseCap (cteCap rv) final False;
if capRemovable remainder slot' then returnOk (True, info) else if \<not> expo \<and> capCyclicZombie remainder slot' then do updateCap slot' remainder;
returnOk (False, capability.NullCap)
od else do updateCap slot' remainder;
doE reduceZombie remainder slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))
 2. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?A11 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?A11 rv) (?C'11 rv) [SKIP] (if isNullCap (cteCap rv) then cutMon ((=) s) (returnOk (True, capability.NullCap)) else cutMon ((=) s) (do final <- isFinalCapability rv;
(remainder, info) <- global.finaliseCap (cteCap rv) final False;
if capRemovable remainder slot' then returnOk (True, info) else if \<not> expo \<and> capCyclicZombie remainder slot' then do updateCap slot' remainder;
returnOk (False, capability.NullCap)
od else do updateCap slot' remainder;
doE reduceZombie remainder slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))
 2. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?A11 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?A11 rv) (?Q'15 rv s) [SKIP] (if isNullCap (cteCap rv) then cutMon ((=) s) (returnOk (True, capability.NullCap)) else cutMon ((=) s) (do final <- isFinalCapability rv;
(remainder, info) <- global.finaliseCap (cteCap rv) final False;
if capRemovable remainder slot' then returnOk (True, info) else if \<not> expo \<and> capCyclicZombie remainder slot' then do updateCap slot' remainder;
returnOk (False, capability.NullCap)
od else do updateCap slot' remainder;
doE reduceZombie remainder slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)) (While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))
 2. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) (?Q'15 rv s)
 3. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); ?A11 rv sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 4. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?A11 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?A11 rv) (?Q'15 rv s) [SKIP] (if isNullCap (cteCap rv) then cutMon ((=) s) (returnOk (True, capability.NullCap)) else cutMon ((=) s) (do final <- isFinalCapability rv;
(remainder, info) <- global.finaliseCap (cteCap rv) final False;
if capRemovable remainder slot' then returnOk (True, info) else if \<not> expo \<and> capCyclicZombie remainder slot' then do updateCap slot' remainder;
returnOk (False, capability.NullCap)
od else do updateCap slot' remainder;
doE reduceZombie remainder slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)) (IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))
ELSE
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))
FI)
 2. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) (?Q'15 rv s)
 3. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); ?A11 rv sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 4. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?A11 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rv' t t'. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))
ELSE
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))
FI) (?d'22 rv s rv')
 2. \<And>rv s rv'. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?A11 rv) (?G'22 rv s rv') [SKIP] (if isNullCap (cteCap rv) then cutMon ((=) s) (returnOk (True, capability.NullCap)) else cutMon ((=) s) (do final <- isFinalCapability rv;
(remainder, info) <- global.finaliseCap (cteCap rv) final False;
if capRemovable remainder slot' then returnOk (True, info) else if \<not> expo \<and> capCyclicZombie remainder slot' then do updateCap slot' remainder;
returnOk (False, capability.NullCap)
od else do updateCap slot' remainder;
doE reduceZombie remainder slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)) (?d'22 rv s rv')
 3. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {sa. sa \<in> ?G'22 rv s (ret__unsigned_' sa)}
 4. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); ?A11 rv sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 5. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?A11 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv s rv'. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?A11 rv) (?G'22 rv s rv') [SKIP] (if isNullCap (cteCap rv) then cutMon ((=) s) (returnOk (True, capability.NullCap)) else cutMon ((=) s) (do final <- isFinalCapability rv;
(remainder, info) <- global.finaliseCap (cteCap rv) final False;
if capRemovable remainder slot' then returnOk (True, info) else if \<not> expo \<and> capCyclicZombie remainder slot' then do updateCap slot' remainder;
returnOk (False, capability.NullCap)
od else do updateCap slot' remainder;
doE reduceZombie remainder slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))
ELSE
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))
FI)
 2. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {sa. sa \<in> ?G'22 rv s (ret__unsigned_' sa)}
 3. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); ?A11 rv sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 4. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?A11 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?A11 rv) (?G'853 rv s rv') [SKIP] (if isNullCap (cteCap rv) then cutMon ((=) s) (returnOk (True, capability.NullCap)) else cutMon ((=) s) (do final <- isFinalCapability rv;
(remainder, info) <- global.finaliseCap (cteCap rv) final False;
if capRemovable remainder slot' then returnOk (True, info) else if \<not> expo \<and> capCyclicZombie remainder slot' then do updateCap slot' remainder;
returnOk (False, capability.NullCap)
od else do updateCap slot' remainder;
doE reduceZombie remainder slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))
ELSE
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))
FI)
 2. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {sa. sa \<in> ?G'853 rv s (ret__unsigned_' sa) \<inter> \<lbrace>(\<^bsup>sa\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 3. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); ?A11 rv sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 4. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?A11 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap); isNullCap (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q856 rv) (?S854 rv s rv') [SKIP] (cutMon ((=) s) (returnOk (True, capability.NullCap))) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))
ELSE
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))
FI)
 2. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap); \<not> isNullCap (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R858 rv) (?T854 rv s rv') [SKIP] (cutMon ((=) s) (do final <- isFinalCapability rv;
(remainder, info) <- global.finaliseCap (cteCap rv) final False;
if capRemovable remainder slot' then returnOk (True, info) else if \<not> expo \<and> capCyclicZombie remainder slot' then do updateCap slot' remainder;
returnOk (False, capability.NullCap)
od else do updateCap slot' remainder;
doE reduceZombie remainder slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))
ELSE
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))
FI)
 3. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {sa. sa \<in> {sb. (isNullCap (cteCap rv) \<longrightarrow> sb \<in> ?S854 rv s (ret__unsigned_' sa)) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> sb \<in> ?T854 rv s (ret__unsigned_' sa))} \<inter> \<lbrace>(\<^bsup>sa\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 4. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> ?Q856 rv sa) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> ?R858 rv sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 5. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> ?Q856 rv s) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> ?R858 rv s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q856 rv) (?S854 rv s (SCAST(32 signed \<rightarrow> 32) cap_null_cap)) [SKIP] (cutMon ((=) s) (returnOk (True, capability.NullCap))) (\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))
 2. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap); \<not> isNullCap (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R858 rv) (?T854 rv s rv') [SKIP] (cutMon ((=) s) (do final <- isFinalCapability rv;
(remainder, info) <- global.finaliseCap (cteCap rv) final False;
if capRemovable remainder slot' then returnOk (True, info) else if \<not> expo \<and> capCyclicZombie remainder slot' then do updateCap slot' remainder;
returnOk (False, capability.NullCap)
od else do updateCap slot' remainder;
doE reduceZombie remainder slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))
ELSE
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))
FI)
 3. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {sa. sa \<in> {sb. (isNullCap (cteCap rv) \<longrightarrow> sb \<in> ?S854 rv s (ret__unsigned_' sa)) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> sb \<in> ?T854 rv s (ret__unsigned_' sa))} \<inter> \<lbrace>(\<^bsup>sa\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 4. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> ?Q856 rv sa) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> ?R858 rv sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 5. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> ?Q856 rv s) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> ?R858 rv s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q856 rv) (?S854 rv s (SCAST(32 signed \<rightarrow> 32) cap_null_cap)) [SKIP] (returnOk (True, capability.NullCap)) (\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))
 2. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap); \<not> isNullCap (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R858 rv) (?T854 rv s rv') [SKIP] (cutMon ((=) s) (do final <- isFinalCapability rv;
(remainder, info) <- global.finaliseCap (cteCap rv) final False;
if capRemovable remainder slot' then returnOk (True, info) else if \<not> expo \<and> capCyclicZombie remainder slot' then do updateCap slot' remainder;
returnOk (False, capability.NullCap)
od else do updateCap slot' remainder;
doE reduceZombie remainder slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))
ELSE
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))
FI)
 3. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {sa. sa \<in> {sb. (isNullCap (cteCap rv) \<longrightarrow> sb \<in> ?S854 rv s (ret__unsigned_' sa)) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> sb \<in> ?T854 rv s (ret__unsigned_' sa))} \<inter> \<lbrace>(\<^bsup>sa\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 4. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> ?Q856 rv sa) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> ?R858 rv sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 5. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> ?Q856 rv s) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> ?R858 rv s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv = capability.NullCap\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))) {},{s. \<exists>(rv, \<sigma>')\<in>fst (returnOk (True, capability.NullCap) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) rv (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_' s)}
 2. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap); \<not> isNullCap (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R858 rv) (?T854 rv s rv') [SKIP] (cutMon ((=) s) (do final <- isFinalCapability rv;
(remainder, info) <- global.finaliseCap (cteCap rv) final False;
if capRemovable remainder slot' then returnOk (True, info) else if \<not> expo \<and> capCyclicZombie remainder slot' then do updateCap slot' remainder;
returnOk (False, capability.NullCap)
od else do updateCap slot' remainder;
doE reduceZombie remainder slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))
ELSE
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))
FI)
 3. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {sa. sa \<in> {sb. (isNullCap (cteCap rv) \<longrightarrow> sb \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> sb \<in> ?T854 rv s (ret__unsigned_' sa))} \<inter> \<lbrace>(\<^bsup>sa\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 4. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> ?R858 rv sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 5. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> ?R858 rv s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rv' \<sigma>. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv = capability.NullCap\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (returnOk (True, capability.NullCap) \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' t, ret___struct_finaliseSlot_ret_C_' := finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' t) (finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_finaliseSlot_ret_C_' s))), ret__struct_finaliseSlot_ret_C_' := finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' t) (finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_finaliseSlot_ret_C_' s))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) rv (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_' (s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' t, ret___struct_finaliseSlot_ret_C_' := finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' t) (finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_finaliseSlot_ret_C_' s))), ret__struct_finaliseSlot_ret_C_' := finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' t) (finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_finaliseSlot_ret_C_' s))), global_exn_var_' := Return\<rparr>)))}
 2. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap); \<not> isNullCap (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R858 rv) (?T854 rv s rv') [SKIP] (cutMon ((=) s) (do final <- isFinalCapability rv;
(remainder, info) <- global.finaliseCap (cteCap rv) final False;
if capRemovable remainder slot' then returnOk (True, info) else if \<not> expo \<and> capCyclicZombie remainder slot' then do updateCap slot' remainder;
returnOk (False, capability.NullCap)
od else do updateCap slot' remainder;
doE reduceZombie remainder slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))
ELSE
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))
FI)
 3. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {sa. sa \<in> {sb. (isNullCap (cteCap rv) \<longrightarrow> sb \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> sb \<in> ?T854 rv s (ret__unsigned_' sa))} \<inter> \<lbrace>(\<^bsup>sa\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 4. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> ?R858 rv sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 5. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> ?R858 rv s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap); \<not> isNullCap (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R858 rv) (?T854 rv s rv') [SKIP] (cutMon ((=) s) (do final <- isFinalCapability rv;
(remainder, info) <- global.finaliseCap (cteCap rv) final False;
if capRemovable remainder slot' then returnOk (True, info) else if \<not> expo \<and> capCyclicZombie remainder slot' then do updateCap slot' remainder;
returnOk (False, capability.NullCap)
od else do updateCap slot' remainder;
doE reduceZombie remainder slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool expo \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))
ELSE
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))
FI)
 2. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {sa. sa \<in> {sb. (isNullCap (cteCap rv) \<longrightarrow> sb \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> sb \<in> ?T854 rv s (ret__unsigned_' sa))} \<inter> \<lbrace>(\<^bsup>sa\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 3. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> ?R858 rv sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 4. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> ?R858 rv s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R858 rv) (?T854 rv s rv') [SKIP] (do rva <- cutMon ((=) s) (isFinalCapability rv);
cutMon (\<lambda>s'. (rva, s') \<in> fst (isFinalCapability rv s)) (do p <- global.finaliseCap (cteCap rv) rva False;
if capRemovable (fst p) slot' then returnOk (True, snd p) else if \<not> expo \<and> capCyclicZombie (fst p) slot' then do updateCap slot' (fst p);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst p);
doE reduceZombie (fst p) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)
od) (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if from_bool expo = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if from_bool expo = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))
 2. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {sa. sa \<in> {sb. (isNullCap (cteCap rv) \<longrightarrow> sb \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> sb \<in> ?T854 rv s (ret__unsigned_' sa))} \<inter> \<lbrace>(\<^bsup>sa\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 3. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> ?R858 rv sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 4. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> ?R858 rv s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R858 rv) (?T854 rv s rv') [SKIP] (do rva <- isFinalCapability rv;
cutMon (\<lambda>s'. (rva, s') \<in> fst (isFinalCapability rv s)) (do p <- global.finaliseCap (cteCap rv) rva False;
if capRemovable (fst p) slot' then returnOk (True, snd p) else if \<not> expo \<and> capCyclicZombie (fst p) slot' then do updateCap slot' (fst p);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst p);
doE reduceZombie (fst p) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)
od) (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if from_bool expo = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if from_bool expo = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))
 2. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {sa. sa \<in> {sb. (isNullCap (cteCap rv) \<longrightarrow> sb \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> sb \<in> ?T854 rv s (ret__unsigned_' sa))} \<inter> \<lbrace>(\<^bsup>sa\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 3. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> ?R858 rv sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 4. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> ?R858 rv s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R858 rv) (?T854 rv s rv') [SKIP] (do rva <- isFinalCapability rv;
cutMon (\<lambda>s'. (rva, s') \<in> fst (isFinalCapability rv s)) (do p <- global.finaliseCap (cteCap rv) rva False;
if capRemovable (fst p) slot' then returnOk (True, snd p) else if \<not> expo \<and> capCyclicZombie (fst p) slot' then do updateCap slot' (fst p);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst p);
doE reduceZombie (fst p) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)
od) (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))
 2. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {sa. sa \<in> {sb. (isNullCap (cteCap rv) \<longrightarrow> sb \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> sb \<in> ?T854 rv s (ret__unsigned_' sa))} \<inter> \<lbrace>(\<^bsup>sa\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 3. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> ?R858 rv sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 4. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> ?R858 rv s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R858 rv) (?T854 rv s rv') [SKIP] (do rva <- isFinalCapability rv;
cutMon (\<lambda>s'. (rva, s') \<in> fst (isFinalCapability rv s)) (do p <- global.finaliseCap (cteCap rv) rva False;
if capRemovable (fst p) slot' then returnOk (True, snd p) else if \<not> expo \<and> capCyclicZombie (fst p) slot' then do updateCap slot' (fst p);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst p);
doE reduceZombie (fst p) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)
od) (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
(\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))))))
 2. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {sa. sa \<in> {sb. (isNullCap (cteCap rv) \<longrightarrow> sb \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> sb \<in> ?T854 rv s (ret__unsigned_' sa))} \<inter> \<lbrace>(\<^bsup>sa\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 3. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> ?R858 rv sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 4. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> ?R858 rv s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rv' rva final. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q949 rv s rv' rva) (?Q'949 rv s rv' rva final) [SKIP] (cutMon (\<lambda>s'. (rva, s') \<in> fst (isFinalCapability rv s)) (do p <- global.finaliseCap (cteCap rv) rva False;
if capRemovable (fst p) slot' then returnOk (True, snd p) else if \<not> expo \<and> capCyclicZombie (fst p) slot' then do updateCap slot' (fst p);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst p);
doE reduceZombie (fst p) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od
od)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),final,SCAST(32 signed \<rightarrow> 32) false));;
(\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))))))
 2. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>?Q949 rv s rv'\<rbrace>
 3. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {sa. sa \<in> {sb. (isNullCap (cteCap rv) \<longrightarrow> sb \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> sb \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'949 rv s (ret__unsigned_' sa) rva (ret__unsigned_long_' t)})} \<inter> \<lbrace>(\<^bsup>sa\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 4. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 5. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q949 rv s rv' rva) (?Q'949 rv s rv' rva final) [SKIP] (do rvb <- cutMon ((=) sa) (global.finaliseCap (cteCap rv) rva False);
cutMon (\<lambda>s'. (rvb, s') \<in> fst (global.finaliseCap (cteCap rv) rva False sa)) (if capRemovable (fst rvb) slot' then returnOk (True, snd rvb) else if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),final,SCAST(32 signed \<rightarrow> 32) false));;
(\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))))))
 2. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>?Q949 rv s rv'\<rbrace>
 3. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {sa. sa \<in> {sb. (isNullCap (cteCap rv) \<longrightarrow> sb \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> sb \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'949 rv s (ret__unsigned_' sa) rva (ret__unsigned_long_' t)})} \<inter> \<lbrace>(\<^bsup>sa\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 4. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 5. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q949 rv s rv' rva) (?Q'949 rv s rv' rva final) [SKIP] (do rvb <- global.finaliseCap (cteCap rv) rva False;
cutMon (\<lambda>s'. (rvb, s') \<in> fst (global.finaliseCap (cteCap rv) rva False sa)) (if capRemovable (fst rvb) slot' then returnOk (True, snd rvb) else if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),final,SCAST(32 signed \<rightarrow> 32) false));;
(\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))))))
 2. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>?Q949 rv s rv'\<rbrace>
 3. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {sa. sa \<in> {sb. (isNullCap (cteCap rv) \<longrightarrow> sb \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> sb \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'949 rv s (ret__unsigned_' sa) rva (ret__unsigned_long_' t)})} \<inter> \<lbrace>(\<^bsup>sa\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 4. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 5. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?A1869 rv s rv' rva) (?C'1871 rv s rv' rva final) [SKIP] (do rvb <- global.finaliseCap (cteCap rv) rva False;
cutMon (\<lambda>s'. (rvb, s') \<in> fst (global.finaliseCap (cteCap rv) rva False sa)) (if capRemovable (fst rvb) slot' then returnOk (True, snd rvb) else if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)
od) (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),final,SCAST(32 signed \<rightarrow> 32) false);;
(\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))))))
 2. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. ?A1869 rv s rv' rva and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 3. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {sa. sa \<in> {sb. (isNullCap (cteCap rv) \<longrightarrow> sb \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> sb \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?C'1871 rv s (ret__unsigned_' sa) rva (ret__unsigned_long_' t) \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>sa\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 4. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 5. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q1873 rv s rv' rva final sa) (?Q'1873 rv s rv' rva final sa) [SKIP] (do rvb <- global.finaliseCap (cteCap rv) rva False;
cutMon (\<lambda>s'. (rvb, s') \<in> fst (global.finaliseCap (cteCap rv) rva False sa)) (if capRemovable (fst rvb) slot' then returnOk (True, snd rvb) else if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)
od) (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),final,SCAST(32 signed \<rightarrow> 32) false);;
(\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))))))
 2. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1873 rv s rv' rva final sa sb \<and> s'a \<in> ?Q'1873 rv s rv' rva final sa
 3. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 4. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 5. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 6. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q1877 rv s rv' rva final sa rvb) (?Q'1877 rv s rv' rva final sa rvb fc_ret) [SKIP] (cutMon (\<lambda>s'. (rvb, s') \<in> fst (global.finaliseCap (cteCap rv) rva False sa)) (if capRemovable (fst rvb) slot' then returnOk (True, snd rvb) else if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C fc_ret,cte_Ptr slot');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))))
 2. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>?Q1877 rv s rv' rva final sa\<rbrace>
 3. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ccap_relation (fst rvb) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'1877 rv s rv' rva final sa rvb (ret__struct_finaliseCap_ret_C_' t)}
 4. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 6. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 7. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q1877 rv s rv' rva final sa rvb) (?Q'1877 rv s rv' rva final sa rvb fc_ret) [SKIP] (do _ <- return ();
cutMon (\<lambda>s'. (rvb, s') \<in> fst (global.finaliseCap (cteCap rv) rva False sa)) (if capRemovable (fst rvb) slot' then returnOk (True, snd rvb) else if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)
od) (\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C fc_ret,cte_Ptr slot');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))))
 2. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>?Q1877 rv s rv' rva final sa\<rbrace>
 3. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ccap_relation (fst rvb) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'1877 rv s rv' rva final sa rvb (ret__struct_finaliseCap_ret_C_' t)}
 4. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 6. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 7. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (11 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (?P2757 rv s rv' rva final sa rvb) (?Q'1877 rv s rv' rva final sa rvb fc_ret) [] (return ()) (\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C fc_ret,cte_Ptr slot'))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv'a t t' (IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))) (?d'2755 rv s rv' rva final sa rvb fc_ret rv'a)
 3. \<And>rv s rv' rva final sa rvb fc_ret rvc rv'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool (capRemovable (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q2755 rv s rv' rva final sa rvb fc_ret rvc) (?Q'2755 rv s rv' rva final sa rvb fc_ret rvc rv'a) [SKIP] (cutMon (\<lambda>s'. (rvb, s') \<in> fst (global.finaliseCap (cteCap rv) rva False sa)) (if capRemovable (fst rvb) slot' then returnOk (True, snd rvb) else if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (?d'2755 rv s rv' rva final sa rvb fc_ret rv'a)
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>?Q2755 rv s rv' rva final sa rvb fc_ret\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (?Q'2755 rv s rv' rva final sa rvb fc_ret)
 6. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. ?P2757 rv s rv' rva final sa rvb and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 7. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ccap_relation (fst rvb) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'1877 rv s rv' rva final sa rvb (ret__struct_finaliseCap_ret_C_' t)}
 8. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 9. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 10. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C fc_ret,cte_Ptr slot') {s. \<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ret__unsigned_long_' s = from_bool (capRemovable (fst rvb) slot')}
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv'a t t' (IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))) (?d'2755 rv s rv' rva final sa rvb fc_ret rv'a)
 3. \<And>rv s rv' rva final sa rvb fc_ret rvc rv'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool (capRemovable (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q2755 rv s rv' rva final sa rvb fc_ret rvc) (?Q'2755 rv s rv' rva final sa rvb fc_ret rvc rv'a) [SKIP] (cutMon (\<lambda>s'. (rvb, s') \<in> fst (global.finaliseCap (cteCap rv) rva False sa)) (if capRemovable (fst rvb) slot' then returnOk (True, snd rvb) else if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (?d'2755 rv s rv' rva final sa rvb fc_ret rv'a)
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>?Q2755 rv s rv' rva final sa rvb fc_ret\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (?Q'2755 rv s rv' rva final sa rvb fc_ret)
 6. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 7. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 8. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 9. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 10. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret \<sigma>. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> {s. (capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>cap. ccap_relation cap (remainder_C fc_ret) \<and> (isZombie cap \<or> cap = capability.NullCap) \<and> capAligned cap \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (capRemovable cap (ptr_val (cte_Ptr slot'))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := from_bool (capRemovable cap (ptr_val (cte_Ptr slot')))\<rparr>) \<in> rf_sr \<and> from_bool (capRemovable cap (ptr_val (cte_Ptr slot'))) = from_bool (capRemovable (fst rvb) slot')))}
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv'a t t' (IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))) (?d'2755 rv s rv' rva final sa rvb fc_ret rv'a)
 3. \<And>rv s rv' rva final sa rvb fc_ret rvc rv'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool (capRemovable (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q2755 rv s rv' rva final sa rvb fc_ret rvc) (?Q'2755 rv s rv' rva final sa rvb fc_ret rvc rv'a) [SKIP] (cutMon (\<lambda>s'. (rvb, s') \<in> fst (global.finaliseCap (cteCap rv) rva False sa)) (if capRemovable (fst rvb) slot' then returnOk (True, snd rvb) else if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (?d'2755 rv s rv' rva final sa rvb fc_ret rv'a)
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>?Q2755 rv s rv' rva final sa rvb fc_ret\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (?Q'2755 rv s rv' rva final sa rvb fc_ret)
 6. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 7. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 8. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 9. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 10. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv s rv' rva sa a b fc_ret \<sigma> x. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation a (remainder_C fc_ret); ccap_relation b (finaliseCap_ret_C.cleanupInfo_C fc_ret); capAligned a; isZombie a \<or> a = capability.NullCap; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<exists>cap. ccap_relation cap (remainder_C fc_ret) \<and> (isZombie cap \<or> cap = capability.NullCap) \<and> capAligned cap \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (capRemovable cap slot')) \<longrightarrow> capRemovable cap slot' = capRemovable a slot')
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv'a t t' (IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))) (?d'2755 rv s rv' rva final sa rvb fc_ret rv'a)
 3. \<And>rv s rv' rva final sa rvb fc_ret rvc rv'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool (capRemovable (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q2755 rv s rv' rva final sa rvb fc_ret rvc) (?Q'2755 rv s rv' rva final sa rvb fc_ret rvc rv'a) [SKIP] (cutMon (\<lambda>s'. (rvb, s') \<in> fst (global.finaliseCap (cteCap rv) rva False sa)) (if capRemovable (fst rvb) slot' then returnOk (True, snd rvb) else if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (?d'2755 rv s rv' rva final sa rvb fc_ret rv'a)
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>?Q2755 rv s rv' rva final sa rvb fc_ret\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (?Q'2755 rv s rv' rva final sa rvb fc_ret)
 6. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 7. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 8. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 9. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 10. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv'a t t' (IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))) (?d'2755 rv s rv' rva final sa rvb fc_ret rv'a)
 2. \<And>rv s rv' rva final sa rvb fc_ret rvc rv'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool (capRemovable (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q2755 rv s rv' rva final sa rvb fc_ret rvc) (?Q'2755 rv s rv' rva final sa rvb fc_ret rvc rv'a) [SKIP] (cutMon (\<lambda>s'. (rvb, s') \<in> fst (global.finaliseCap (cteCap rv) rva False sa)) (if capRemovable (fst rvb) slot' then returnOk (True, snd rvb) else if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (?d'2755 rv s rv' rva final sa rvb fc_ret rv'a)
 3. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>?Q2755 rv s rv' rva final sa rvb fc_ret\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (?Q'2755 rv s rv' rva final sa rvb fc_ret)
 5. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 6. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 7. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 8. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 9. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 10. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rvc rv'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool (capRemovable (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q2755 rv s rv' rva final sa rvb fc_ret rvc) (?Q'2755 rv s rv' rva final sa rvb fc_ret rvc rv'a) [SKIP] (cutMon (\<lambda>s'. (rvb, s') \<in> fst (global.finaliseCap (cteCap rv) rva False sa)) (if capRemovable (fst rvb) slot' then returnOk (True, snd rvb) else if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (IF rv'a \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>?Q2755 rv s rv' rva final sa rvb fc_ret\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (?Q'2755 rv s rv' rva final sa rvb fc_ret)
 4. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 5. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 6. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 7. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 8. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 9. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rvc rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool (capRemovable (fst rvb) slot'); (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q2755 rv s rv' rva final sa rvb fc_ret rvc) (?Q'2755 rv s rv' rva final sa rvb fc_ret rvc rv'a) [SKIP] (cutMon ((=) sb) (if capRemovable (fst rvb) slot' then returnOk (True, snd rvb) else if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (IF rv'a \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>?Q2755 rv s rv' rva final sa rvb fc_ret\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (?Q'2755 rv s rv' rva final sa rvb fc_ret)
 4. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 5. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 6. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 7. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 8. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 9. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool (capRemovable (fst rvb) slot'); (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q2755 rv s rv' rva final sa rvb fc_ret ()) (?Q'2755 rv s rv' rva final sa rvb fc_ret () (from_bool (capRemovable (fst rvb) slot'))) [SKIP] (if capRemovable (fst rvb) slot' then cutMon ((=) sb) (returnOk (True, snd rvb)) else cutMon ((=) sb) (if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (IF capRemovable (fst rvb) slot' THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>?Q2755 rv s rv' rva final sa rvb fc_ret\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (?Q'2755 rv s rv' rva final sa rvb fc_ret)
 4. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 5. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 6. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 7. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 8. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 9. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool (capRemovable (fst rvb) slot'); (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); capRemovable (fst rvb) slot'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3102 rv s rv' rva final sa rvb fc_ret ()) (?S3105 rv s rv' rva final sa rvb fc_ret () (from_bool (capRemovable (fst rvb) slot'))) [SKIP] (cutMon ((=) sb) (returnOk (True, snd rvb))) (IF capRemovable (fst rvb) slot' THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool (capRemovable (fst rvb) slot'); (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3101 rv s rv' rva final sa rvb fc_ret ()) (?T3103 rv s rv' rva final sa rvb fc_ret () (from_bool (capRemovable (fst rvb) slot'))) [SKIP] (cutMon ((=) sb) (if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (IF capRemovable (fst rvb) slot' THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))))
 3. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a b. (capRemovable (fst rvb) slot' \<longrightarrow> ?Q3102 rv s rv' rva final sa rvb fc_ret a b) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ?R3101 rv s rv' rva final sa rvb fc_ret a b)\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> ?S3105 rv s rv' rva final sa rvb fc_ret a b) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> ?T3103 rv s rv' rva final sa rvb fc_ret a b)})
 5. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 6. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 7. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 8. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 9. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 10. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) true; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); capRemovable (fst rvb) slot'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3102 rv s rv' rva final sa rvb fc_ret ()) (?S3105 rv s rv' rva final sa rvb fc_ret () (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (cutMon ((=) sb) (returnOk (True, snd rvb))) (\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool (capRemovable (fst rvb) slot'); (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3101 rv s rv' rva final sa rvb fc_ret ()) (?T3103 rv s rv' rva final sa rvb fc_ret () (from_bool (capRemovable (fst rvb) slot'))) [SKIP] (cutMon ((=) sb) (if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (IF capRemovable (fst rvb) slot' THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))))
 3. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a b. (capRemovable (fst rvb) slot' \<longrightarrow> ?Q3102 rv s rv' rva final sa rvb fc_ret a b) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ?R3101 rv s rv' rva final sa rvb fc_ret a b)\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> ?S3105 rv s rv' rva final sa rvb fc_ret a b) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> ?T3103 rv s rv' rva final sa rvb fc_ret a b)})
 5. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 6. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 7. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 8. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 9. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 10. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (11 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) true; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); capRemovable (fst rvb) slot'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3102 rv s rv' rva final sa rvb fc_ret ()) (?P'3123 rv s rv' rva final sa rvb fc_ret () (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (returnOk (True, snd rvb)) (\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_')
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) true; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); capRemovable (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3122 rv s rv' rva final sa rvb fc_ret () (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_' {},UNIV
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool (capRemovable (fst rvb) slot'); (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3101 rv s rv' rva final sa rvb fc_ret ()) (?T3103 rv s rv' rva final sa rvb fc_ret () (from_bool (capRemovable (fst rvb) slot'))) [SKIP] (cutMon ((=) sb) (if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (IF capRemovable (fst rvb) slot' THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))))
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a b. (capRemovable (fst rvb) slot' \<longrightarrow> ?Q3102 rv s rv' rva final sa rvb fc_ret a b) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ?R3101 rv s rv' rva final sa rvb fc_ret a b)\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> ?P'3123 rv s rv' rva final sa rvb fc_ret a b \<inter> ?R'3122 rv s rv' rva final sa rvb fc_ret a b) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> ?T3103 rv s rv' rva final sa rvb fc_ret a b)})
 6. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 7. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 8. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 9. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 10. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) true; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); capRemovable (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (returnOk (True, snd rvb) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) rv (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_' s)}
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) true; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); capRemovable (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3122 rv s rv' rva final sa rvb fc_ret () (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_' {},UNIV
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool (capRemovable (fst rvb) slot'); (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3101 rv s rv' rva final sa rvb fc_ret ()) (?T3103 rv s rv' rva final sa rvb fc_ret () (from_bool (capRemovable (fst rvb) slot'))) [SKIP] (cutMon ((=) sb) (if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (IF capRemovable (fst rvb) slot' THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))))
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ?R3101 rv s rv' rva final sa rvb fc_ret a aa)\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> ?R'3122 rv s rv' rva final sa rvb fc_ret a b) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> ?T3103 rv s rv' rva final sa rvb fc_ret a b)})
 6. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 7. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 8. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 9. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 10. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb \<sigma>. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) true; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); capRemovable (fst rvb) slot'\<rbrakk> \<Longrightarrow> {s. (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (returnOk (True, snd rvb) \<sigma>). (\<sigma>', s\<lparr>ret___struct_finaliseSlot_ret_C_' := finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) (finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_finaliseSlot_ret_C_' s))), ret__struct_finaliseSlot_ret_C_' := finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) (finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_finaliseSlot_ret_C_' s))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) rv (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_' (s\<lparr>ret___struct_finaliseSlot_ret_C_' := finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) (finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_finaliseSlot_ret_C_' s))), ret__struct_finaliseSlot_ret_C_' := finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) (finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_finaliseSlot_ret_C_' s))), global_exn_var_' := Return\<rparr>))}
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) true; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); capRemovable (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3122 rv s rv' rva final sa rvb fc_ret () (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_' {},UNIV
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool (capRemovable (fst rvb) slot'); (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3101 rv s rv' rva final sa rvb fc_ret ()) (?T3103 rv s rv' rva final sa rvb fc_ret () (from_bool (capRemovable (fst rvb) slot'))) [SKIP] (cutMon ((=) sb) (if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (IF capRemovable (fst rvb) slot' THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))))
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ?R3101 rv s rv' rva final sa rvb fc_ret a aa)\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> ?R'3122 rv s rv' rva final sa rvb fc_ret a b) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> ?T3103 rv s rv' rva final sa rvb fc_ret a b)})
 6. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 7. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 8. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 9. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 10. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv s rv' rva sa a b fc_ret sb \<sigma> x. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; (rva, sa) \<in> fst (isFinalCapability rv s); ((a, b), sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); capRemovable a slot'; ccap_relation a (remainder_C fc_ret); ccap_relation b (finaliseCap_ret_C.cleanupInfo_C fc_ret); case b of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> cleanup_info_wf' b
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) true; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); capRemovable (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3122 rv s rv' rva final sa rvb fc_ret () (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_' {},UNIV
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool (capRemovable (fst rvb) slot'); (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3101 rv s rv' rva final sa rvb fc_ret ()) (?T3103 rv s rv' rva final sa rvb fc_ret () (from_bool (capRemovable (fst rvb) slot'))) [SKIP] (cutMon ((=) sb) (if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (IF capRemovable (fst rvb) slot' THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))))
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ?R3101 rv s rv' rva final sa rvb fc_ret a aa)\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> ?R'3122 rv s rv' rva final sa rvb fc_ret a b) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> ?T3103 rv s rv' rva final sa rvb fc_ret a b)})
 6. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 7. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 8. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 9. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 10. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) true; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); capRemovable (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3122 rv s rv' rva final sa rvb fc_ret () (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_' {},UNIV
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool (capRemovable (fst rvb) slot'); (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3101 rv s rv' rva final sa rvb fc_ret ()) (?T3103 rv s rv' rva final sa rvb fc_ret () (from_bool (capRemovable (fst rvb) slot'))) [SKIP] (cutMon ((=) sb) (if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (IF capRemovable (fst rvb) slot' THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))))
 3. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ?R3101 rv s rv' rva final sa rvb fc_ret a aa)\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> ?R'3122 rv s rv' rva final sa rvb fc_ret a b) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> ?T3103 rv s rv' rva final sa rvb fc_ret a b)})
 5. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 6. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 7. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 8. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 9. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 10. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool (capRemovable (fst rvb) slot'); (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3101 rv s rv' rva final sa rvb fc_ret ()) (?T3103 rv s rv' rva final sa rvb fc_ret () (from_bool (capRemovable (fst rvb) slot'))) [SKIP] (cutMon ((=) sb) (if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od else do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (IF capRemovable (fst rvb) slot' THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ?R3101 rv s rv' rva final sa rvb fc_ret a aa)\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> ?T3103 rv s rv' rva final sa rvb fc_ret a b)})
 4. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 5. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 6. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 7. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 8. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 9. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3101 rv s rv' rva final sa rvb fc_ret ()) (?T3103 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then cutMon ((=) sb) (do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od) else cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ?R3101 rv s rv' rva final sa rvb fc_ret a aa)\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> ?T3103 rv s rv' rva final sa rvb fc_ret a b)})
 4. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 5. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 6. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 7. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 8. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 9. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?A3252 rv s rv' rva final sa rvb fc_ret ()) (?C'3249 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (if \<not> expo \<and> capCyclicZombie (fst rvb) slot' then cutMon ((=) sb) (do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od) else cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> (?A3252 rv s rv' rva final sa rvb fc_ret a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> ?C'3249 rv s rv' rva final sa rvb fc_ret a b \<inter> \<lbrace>True\<rbrace>)})
 4. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 5. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 6. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 7. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 8. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 9. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3259 rv s rv' rva final sa rvb fc_ret ()) (?S3262 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
returnOk (False, capability.NullCap)
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 3. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ?Q3259 rv s rv' rva final sa rvb fc_ret a aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> ?S3262 rv s rv' rva final sa rvb fc_ret a b) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 5. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 6. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 7. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 8. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 9. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 10. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3259 rv s rv' rva final sa rvb fc_ret ()) (?S3262 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (do rv <- cutMon ((=) sb) (updateCap slot' (fst rvb));
cutMon (\<lambda>s'. (rv, s') \<in> fst (updateCap slot' (fst rvb) sb)) (K_bind (returnOk (False, capability.NullCap)) rv)
od) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> False then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> False then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 3. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ?Q3259 rv s rv' rva final sa rvb fc_ret a aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> ?S3262 rv s rv' rva final sa rvb fc_ret a b) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 5. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 6. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 7. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 8. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 9. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 10. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (14 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3279 rv s rv' rva final sa rvb fc_ret ()) (?S3262 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [] (updateCap slot' (fst rvb)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (\<acute>ret__int :== (if \<not> False then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> False then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))) (?d'3272 rv s rv' rva final sa rvb fc_ret rv'a sb rv'b)
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3272 rv s rv' rva final sa rvb fc_ret rv'a sb rvc) (?Q'3272 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (K_bind (returnOk (False, capability.NullCap)) rvc)) (?d'3272 rv s rv' rva final sa rvb fc_ret rv'a sb rv'b)
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>?Q3272 rv s rv' rva final sa rvb fc_ret rv'a sb\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3272 rv s rv' rva final sa rvb fc_ret rv'a sb)
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 7. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> (?P3279 rv s rv' rva final sa rvb fc_ret a and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> ?S3262 rv s rv' rva final sa rvb fc_ret a b) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 9. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 10. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3281 rv s rv' rva final sa rvb fc_ret rv'a sb) (?Q'3281 rv s rv' rva final sa rvb fc_ret rv'a sb) [] (updateCap slot' (fst rvb)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb sc s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; (sc, s'a) \<in> rf_sr; True; s'a \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q3281 rv s rv' rva final sa rvb fc_ret rv'a sb sc \<and> s'a \<in> ?Q'3281 rv s rv' rva final sa rvb fc_ret rv'a sb
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (\<acute>ret__int :== (if \<not> False then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> False then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))) (?d'3272 rv s rv' rva final sa rvb fc_ret rv'a sb rv'b)
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3272 rv s rv' rva final sa rvb fc_ret rv'a sb rvc) (?Q'3272 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (K_bind (returnOk (False, capability.NullCap)) rvc)) (?d'3272 rv s rv' rva final sa rvb fc_ret rv'a sb rv'b)
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>?Q3272 rv s rv' rva final sa rvb fc_ret rv'a sb\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3272 rv s rv' rva final sa rvb fc_ret rv'a sb)
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 10. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb sc s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; (sc, s'a) \<in> rf_sr; True; s'a \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s'a \<in> \<lbrace>ccap_relation (fst rvb) (remainder_C fc_ret)\<rbrace> \<inter> \<lbrace>cte_Ptr slot' = cte_Ptr slot'\<rbrace>
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (\<acute>ret__int :== (if \<not> False then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> False then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))) (?d'3272 rv s rv' rva final sa rvb fc_ret rv'a sb rv'b)
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3272 rv s rv' rva final sa rvb fc_ret rv'a sb rvc) (?Q'3272 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (K_bind (returnOk (False, capability.NullCap)) rvc)) (?d'3272 rv s rv' rva final sa rvb fc_ret rv'a sb rv'b)
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>?Q3272 rv s rv' rva final sa rvb fc_ret rv'a sb\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3272 rv s rv' rva final sa rvb fc_ret rv'a sb)
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 7. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 9. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 10. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (\<acute>ret__int :== (if \<not> False then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> False then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))) (?d'3272 rv s rv' rva final sa rvb fc_ret rv'a sb rv'b)
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3272 rv s rv' rva final sa rvb fc_ret rv'a sb rvc) (?Q'3272 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (K_bind (returnOk (False, capability.NullCap)) rvc)) (?d'3272 rv s rv' rva final sa rvb fc_ret rv'a sb rv'b)
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>?Q3272 rv s rv' rva final sa rvb fc_ret rv'a sb\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3272 rv s rv' rva final sa rvb fc_ret rv'a sb)
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 6. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 8. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 9. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 10. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3272 rv s rv' rva final sa rvb fc_ret rv'a sb rvc) (?Q'3272 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (K_bind (returnOk (False, capability.NullCap)) rvc)) (\<acute>ret__int :== (if \<not> False then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> False then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>?Q3272 rv s rv' rva final sa rvb fc_ret rv'a sb\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3272 rv s rv' rva final sa rvb fc_ret rv'a sb)
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 7. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 8. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 9. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 10. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3272 rv s rv' rva final sa rvb fc_ret rv'a sb rvc) (?G'3288 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (K_bind (returnOk (False, capability.NullCap)) rvc)) (IF (if \<not> False then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> False then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>?Q3272 rv s rv' rva final sa rvb fc_ret rv'a sb\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {sc. sc\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> ?G'3288 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b})
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 7. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 8. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 9. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 10. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3272 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc) (?G'3288 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (K_bind (returnOk (False, capability.NullCap)) rvc)) (\<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if True then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>?Q3272 rv s rv' rva final sa rvb fc_ret rv'a sb\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {sc. sc\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> ?G'3288 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b})
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 7. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 8. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 9. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 10. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3272 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc) (?G'3288 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (K_bind (returnOk (False, capability.NullCap)) rvc)) (\<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if True then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>?Q3272 rv s rv' rva final sa rvb fc_ret rv'a sb\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {sc. sc\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> ?G'3288 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b})
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 7. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 8. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 9. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 10. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = from_bool True) ret__unsigned_long_' (?P3477 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc) (?G'3288 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b) [] (return ()) (\<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot'))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rv'c t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv'c t t' (\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if True then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))) (?d'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rv'c)
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b; rv'c = from_bool True\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd) (?Q'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (K_bind (returnOk (False, capability.NullCap)) rvc)) (?d'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rv'c)
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3475 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>?Q3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool True) ret__unsigned_long_' (?Q'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b)
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. ?P3477 rv s rv' rva final sa rvb fc_ret rv'a sb a and ?R3475 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {sc. sc\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> ?G'3288 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b})
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 10. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. capAligned (fst rvb) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot') {s. \<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ret__unsigned_long_' s = from_bool True}
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rv'c t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv'c t t' (\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if True then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))) (?d'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rv'c)
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b; rv'c = from_bool True\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd) (?Q'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (K_bind (returnOk (False, capability.NullCap)) rvc)) (?d'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rv'c)
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3475 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>?Q3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool True) ret__unsigned_long_' (?Q'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b)
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R3475 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {s. s\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> UNIV})
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 10. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b \<sigma>. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> {s. capAligned (fst rvb) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>cap. ccap_relation cap (remainder_C fc_ret) \<and> isZombie cap \<and> capAligned cap \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (capCyclicZombie cap (ptr_val (cte_Ptr slot'))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := from_bool (capCyclicZombie cap (ptr_val (cte_Ptr slot')))\<rparr>) \<in> rf_sr \<and> from_bool (capCyclicZombie cap (ptr_val (cte_Ptr slot'))) = from_bool True))}
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rv'c t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv'c t t' (\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if True then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))) (?d'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rv'c)
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b; rv'c = from_bool True\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd) (?Q'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (K_bind (returnOk (False, capability.NullCap)) rvc)) (?d'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rv'c)
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3475 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>?Q3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool True) ret__unsigned_long_' (?Q'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b)
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R3475 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {s. s\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> UNIV})
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 10. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>rv s rv' rva sa b fc_ret sb \<sigma> x zb n. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; (rva, sa) \<in> fst (isFinalCapability rv s); ((capability.Zombie slot' zb n, b), sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (capability.Zombie slot' zb n) slot'; ccap_relation (capability.Zombie slot' zb n) (remainder_C fc_ret); ccap_relation b (finaliseCap_ret_C.cleanupInfo_C fc_ret); \<not> expo; capAligned (capability.Zombie slot' zb n); (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<exists>cap. ccap_relation cap (remainder_C fc_ret) \<and> isZombie cap \<and> capAligned cap \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (capCyclicZombie cap slot')) \<longrightarrow> from_bool (capCyclicZombie cap slot') = SCAST(32 signed \<rightarrow> 32) true)
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rv'c t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv'c t t' (\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if True then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))) (?d'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rv'c)
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b; rv'c = from_bool True\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd) (?Q'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (K_bind (returnOk (False, capability.NullCap)) rvc)) (?d'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rv'c)
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3475 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>?Q3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool True) ret__unsigned_long_' (?Q'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b)
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R3475 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {s. s\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> UNIV})
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 10. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rv'c t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv'c t t' (\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if True then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))) (?d'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rv'c)
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b; rv'c = from_bool True\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd) (?Q'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (K_bind (returnOk (False, capability.NullCap)) rvc)) (?d'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rv'c)
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3475 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>?Q3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool True) ret__unsigned_long_' (?Q'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b)
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R3475 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {s. s\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> UNIV})
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 10. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b; rv'c = from_bool True\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd) (?Q'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (K_bind (returnOk (False, capability.NullCap)) rvc)) (\<acute>ret__int :== (if rv'c \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if True then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3475 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>?Q3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool True) ret__unsigned_long_' (?Q'3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b)
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R3475 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {s. s\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> UNIV})
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 7. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 9. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 10. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b; rv'c = from_bool True\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd) (?G'4234 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (K_bind (returnOk (False, capability.NullCap)) rvc)) (IF (if rv'c \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if True then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool False);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3475 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>?Q3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool True) ret__unsigned_long_' (\<lambda>rvd rv'c. {sc. sc\<lparr>ret__int_' := if rv'c \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4234 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c})
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R3475 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {s. s\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> UNIV})
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 7. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 9. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 10. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) false; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; rv'c = SCAST(32 signed \<rightarrow> 32) true\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3470 rv s rv' rva final sa rvb fc_ret (SCAST(32 signed \<rightarrow> 32) false) sb () rv'b ()) (?G'4234 rv s rv' rva final sa rvb fc_ret (SCAST(32 signed \<rightarrow> 32) false) sb () rv'b () (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (updateCap slot' (fst rvb) sb)) (returnOk (False, capability.NullCap))) (\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',SCAST(32 signed \<rightarrow> 32) false);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3475 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>?Q3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool True) ret__unsigned_long_' (\<lambda>rvd rv'c. {sc. sc\<lparr>ret__int_' := if rv'c \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4234 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c})
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R3475 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {s. s\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> UNIV})
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 7. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 9. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 10. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) false; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; rv'c = SCAST(32 signed \<rightarrow> 32) true\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q3470 rv s rv' rva final sa rvb fc_ret (SCAST(32 signed \<rightarrow> 32) false) sb () rv'b ()) (?P'4975 rv s rv' rva final sa rvb fc_ret (SCAST(32 signed \<rightarrow> 32) false) sb () rv'b () (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (updateCap slot' (fst rvb) sb)) (returnOk (False, capability.NullCap))) (\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_')
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) false; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; rv'c = SCAST(32 signed \<rightarrow> 32) true\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4974 rv s rv' rva final sa rvb fc_ret (SCAST(32 signed \<rightarrow> 32) false) sb () rv'b () (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_' {},UNIV
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3475 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>?Q3470 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool True) ret__unsigned_long_' (\<lambda>rvd rv'c. {sc. sc\<lparr>ret__int_' := if rv'c \<noteq> 0 then 1 else 0\<rparr> \<in> ?P'4975 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c \<inter> ?R'4974 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c})
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R3475 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {s. s\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> UNIV})
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 10. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) false; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; rv'c = SCAST(32 signed \<rightarrow> 32) true\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (returnOk (False, capability.NullCap) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) rv (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_' s)}
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) false; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; rv'c = SCAST(32 signed \<rightarrow> 32) true\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4974 rv s rv' rva final sa rvb fc_ret (SCAST(32 signed \<rightarrow> 32) false) sb () rv'b () (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_' {},UNIV
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3475 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool True) ret__unsigned_long_' (\<lambda>rvd rv'c. {sc. sc\<lparr>ret__int_' := if rv'c \<noteq> 0 then 1 else 0\<rparr> \<in> UNIV \<inter> ?R'4974 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c})
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R3475 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {s. s\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> UNIV})
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 10. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b rv'c \<sigma>. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) false; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; rv'c = SCAST(32 signed \<rightarrow> 32) true\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (returnOk (False, capability.NullCap) \<sigma>). (\<sigma>', s\<lparr>ret___struct_finaliseSlot_ret_C_' := finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) (finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_finaliseSlot_ret_C_' s))), ret__struct_finaliseSlot_ret_C_' := finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) (finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_finaliseSlot_ret_C_' s))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) rv (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_' (s\<lparr>ret___struct_finaliseSlot_ret_C_' := finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) (finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_finaliseSlot_ret_C_' s))), ret__struct_finaliseSlot_ret_C_' := finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) (finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_finaliseSlot_ret_C_' s))), global_exn_var_' := Return\<rparr>))}
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) false; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; rv'c = SCAST(32 signed \<rightarrow> 32) true\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4974 rv s rv' rva final sa rvb fc_ret (SCAST(32 signed \<rightarrow> 32) false) sb () rv'b () (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_' {},UNIV
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3475 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool True) ret__unsigned_long_' (\<lambda>rvd rv'c. {sc. sc\<lparr>ret__int_' := if rv'c \<noteq> 0 then 1 else 0\<rparr> \<in> UNIV \<inter> ?R'4974 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c})
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R3475 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {s. s\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> UNIV})
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 10. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv s rv' rva sa b fc_ret sb \<sigma> x zb n. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; (rva, sa) \<in> fst (isFinalCapability rv s); ((capability.Zombie slot' zb n, b), sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (capability.Zombie slot' zb n) slot'; (\<sigma>, x) \<in> rf_sr; ccap_relation (capability.Zombie slot' zb n) (remainder_C fc_ret); ccap_relation b (finaliseCap_ret_C.cleanupInfo_C fc_ret); \<not> expo\<rbrakk> \<Longrightarrow> ccap_relation capability.NullCap (finaliseCap_ret_C.cleanupInfo_C fc_ret)
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) false; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; rv'c = SCAST(32 signed \<rightarrow> 32) true\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4974 rv s rv' rva final sa rvb fc_ret (SCAST(32 signed \<rightarrow> 32) false) sb () rv'b () (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_' {},UNIV
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3475 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool True) ret__unsigned_long_' (\<lambda>rvd rv'c. {sc. sc\<lparr>ret__int_' := if rv'c \<noteq> 0 then 1 else 0\<rparr> \<in> UNIV \<inter> ?R'4974 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c})
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R3475 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {s. s\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> UNIV})
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 10. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv s rv' rva sa b fc_ret sb \<sigma> x zb n. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; (rva, sa) \<in> fst (isFinalCapability rv s); \<not> capRemovable (capability.Zombie slot' zb n) slot'; (\<sigma>, x) \<in> rf_sr; ccap_relation (capability.Zombie slot' zb n) (remainder_C fc_ret); ccap_relation b (finaliseCap_ret_C.cleanupInfo_C fc_ret); \<not> expo; fst (capability.Zombie slot' zb n, b) = capability.NullCap \<and> (snd (capability.Zombie slot' zb n, b) \<noteq> capability.NullCap \<longrightarrow> rva \<and> cap_has_cleanup' (cteCap rv) \<and> snd (capability.Zombie slot' zb n, b) = cteCap rv) \<or> isZombie (fst (capability.Zombie slot' zb n, b)) \<and> rva \<and> \<not> False \<and> snd (capability.Zombie slot' zb n, b) = capability.NullCap \<and> global.capUntypedPtr (fst (capability.Zombie slot' zb n, b)) = global.capUntypedPtr (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv))\<rbrakk> \<Longrightarrow> ccap_relation capability.NullCap (finaliseCap_ret_C.cleanupInfo_C fc_ret)
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) false; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; rv'c = SCAST(32 signed \<rightarrow> 32) true\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4974 rv s rv' rva final sa rvb fc_ret (SCAST(32 signed \<rightarrow> 32) false) sb () rv'b () (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_' {},UNIV
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3475 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool True) ret__unsigned_long_' (\<lambda>rvd rv'c. {sc. sc\<lparr>ret__int_' := if rv'c \<noteq> 0 then 1 else 0\<rparr> \<in> UNIV \<inter> ?R'4974 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c})
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R3475 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {s. s\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> UNIV})
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 10. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) false; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; rv'c = SCAST(32 signed \<rightarrow> 32) true\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4974 rv s rv' rva final sa rvb fc_ret (SCAST(32 signed \<rightarrow> 32) false) sb () rv'b () (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_' {},UNIV
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3475 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool True) ret__unsigned_long_' (\<lambda>rvd rv'c. {sc. sc\<lparr>ret__int_' := if rv'c \<noteq> 0 then 1 else 0\<rparr> \<in> UNIV \<inter> ?R'4974 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b rvd rv'c})
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R3475 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {s. s\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> UNIV})
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 7. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 9. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 10. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3475 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool True) ret__unsigned_long_' (\<lambda>rvd rv'c. {s. s\<lparr>ret__int_' := if rv'c \<noteq> 0 then 1 else 0\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R3475 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {s. s\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> UNIV})
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 6. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 8. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 9. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 10. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'; dc rvc rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool True) ret__unsigned_long_' (\<lambda>rvd rv'c. {s. s\<lparr>ret__int_' := if rv'c \<noteq> 0 then 1 else 0\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and (\<lambda>a. True)\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {s. s\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> UNIV})
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 7. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 8. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 9. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 10. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R3277 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and (\<lambda>a. True)\<rbrace>
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {s. s\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> UNIV})
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and ?R3277 rv s rv' rva final sa rvb fc_ret a) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 6. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 7. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 8. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 9. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 10. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> expo \<and> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {s. s\<lparr>ret__int_' := if \<not> False then 1 else 0\<rparr> \<in> UNIV})
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 3. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 5. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 6. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 7. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 8. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 9. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 10. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (cutMon ((=) sb) (do updateCap slot' (fst rvb);
doE reduceZombie (fst rvb) slot' expo;
preemptionPoint;
finaliseSlot' slot' expo
odE
od)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 4. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 5. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 6. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 7. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 8. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 9. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?R3258 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [SKIP] (do rv <- cutMon ((=) sb) (updateCap slot' (fst rvb));
cutMon (\<lambda>s'. (rv, s') \<in> fst (updateCap slot' (fst rvb) sb)) (doE a <- reduceZombie (fst rvb) slot' expo;
a <- preemptionPoint;
finaliseSlot' slot' expo
odE)
od) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret)));;
(\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ?R3258 rv s rv' rva final sa rvb fc_ret a aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 4. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 5. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 6. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 7. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 8. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 9. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (13 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P5058 rv s rv' rva final sa rvb fc_ret ()) (?T3260 rv s rv' rva final sa rvb fc_ret () (from_bool False)) [] (updateCap slot' (fst rvb)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))) (?d'5051 rv s rv' rva final sa rvb fc_ret rv'a sb rv'b)
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5051 rv s rv' rva final sa rvb fc_ret rv'a sb rvc) (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (doE a <- reduceZombie (fst rvb) slot' expo;
a <- preemptionPoint;
finaliseSlot' slot' expo
odE)) (?d'5051 rv s rv' rva final sa rvb fc_ret rv'a sb rv'b)
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>?Q5051 rv s rv' rva final sa rvb fc_ret rv'a sb\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb)
 6. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> (?P5058 rv s rv' rva final sa rvb fc_ret a and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {sb. (capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> sb \<in> {sb. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> sb \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> sb \<in> ?T3260 rv s rv' rva final sa rvb fc_ret a b)} \<inter> \<lbrace>True\<rbrace>)})
 8. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 9. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 10. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5060 rv s rv' rva final sa rvb fc_ret rv'a sb) (?Q'5060 rv s rv' rva final sa rvb fc_ret rv'a sb) [] (updateCap slot' (fst rvb)) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C fc_ret))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb sc s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); (sc, s'a) \<in> rf_sr; True; s'a \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q5060 rv s rv' rva final sa rvb fc_ret rv'a sb sc \<and> s'a \<in> ?Q'5060 rv s rv' rva final sa rvb fc_ret rv'a sb
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))) (?d'5051 rv s rv' rva final sa rvb fc_ret rv'a sb rv'b)
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5051 rv s rv' rva final sa rvb fc_ret rv'a sb rvc) (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (doE a <- reduceZombie (fst rvb) slot' expo;
a <- preemptionPoint;
finaliseSlot' slot' expo
odE)) (?d'5051 rv s rv' rva final sa rvb fc_ret rv'a sb rv'b)
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>?Q5051 rv s rv' rva final sa rvb fc_ret rv'a sb\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb)
 7. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 9. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 10. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb sc s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); (sc, s'a) \<in> rf_sr; True; s'a \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s'a \<in> \<lbrace>ccap_relation (fst rvb) (remainder_C fc_ret)\<rbrace> \<inter> \<lbrace>cte_Ptr slot' = cte_Ptr slot'\<rbrace>
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))) (?d'5051 rv s rv' rva final sa rvb fc_ret rv'a sb rv'b)
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5051 rv s rv' rva final sa rvb fc_ret rv'a sb rvc) (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (doE a <- reduceZombie (fst rvb) slot' expo;
a <- preemptionPoint;
finaliseSlot' slot' expo
odE)) (?d'5051 rv s rv' rva final sa rvb fc_ret rv'a sb rv'b)
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>?Q5051 rv s rv' rva final sa rvb fc_ret rv'a sb\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb)
 6. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 8. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 9. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 10. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))) (?d'5051 rv s rv' rva final sa rvb fc_ret rv'a sb rv'b)
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5051 rv s rv' rva final sa rvb fc_ret rv'a sb rvc) (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (doE a <- reduceZombie (fst rvb) slot' expo;
a <- preemptionPoint;
finaliseSlot' slot' expo
odE)) (?d'5051 rv s rv' rva final sa rvb fc_ret rv'a sb rv'b)
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>?Q5051 rv s rv' rva final sa rvb fc_ret rv'a sb\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb)
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 7. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 8. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 9. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 10. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5051 rv s rv' rva final sa rvb fc_ret rv'a sb rvc) (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (doE a <- reduceZombie (fst rvb) slot' expo;
a <- preemptionPoint;
finaliseSlot' slot' expo
odE)) (\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>?Q5051 rv s rv' rva final sa rvb fc_ret rv'a sb\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb)
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 6. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 7. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 8. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 9. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 10. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5051 rv s rv' rva final sa rvb fc_ret rv'a sb rvc) (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (doE a <- reduceZombie (fst rvb) slot' expo;
a <- preemptionPoint;
finaliseSlot' slot' expo
odE)) (\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b\<rbrakk> \<Longrightarrow> isZombie (fst rvb)
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>?Q5051 rv s rv' rva final sa rvb fc_ret rv'a sb\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb)
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 7. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 8. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 9. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 10. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b\<rbrakk> \<Longrightarrow> isZombie (fst rvb)
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5051 rv s rv' rva final sa rvb fc_ret rv'a sb rvc) (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (doE a <- reduceZombie (fst rvb) slot' expo;
a <- preemptionPoint;
finaliseSlot' slot' expo
odE)) (\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>?Q5051 rv s rv' rva final sa rvb fc_ret rv'a sb\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb)
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 7. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 8. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 9. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 10. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; fst rvb = capability.NullCap \<and> (snd rvb \<noteq> capability.NullCap \<longrightarrow> rva \<and> cap_has_cleanup' (cteCap rv) \<and> snd rvb = cteCap rv) \<or> isZombie (fst rvb) \<and> rva \<and> \<not> False \<and> snd rvb = capability.NullCap \<and> global.capUntypedPtr (fst rvb) = global.capUntypedPtr (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv))\<rbrakk> \<Longrightarrow> isZombie (fst rvb)
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5051 rv s rv' rva final sa rvb fc_ret rv'a sb rvc) (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (doE a <- reduceZombie (fst rvb) slot' expo;
a <- preemptionPoint;
finaliseSlot' slot' expo
odE)) (\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>?Q5051 rv s rv' rva final sa rvb fc_ret rv'a sb\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb)
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 7. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 8. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 9. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 10. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5051 rv s rv' rva final sa rvb fc_ret rv'a sb rvc) (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b) [SKIP] (cutMon (\<lambda>s'. (rvc, s') \<in> fst (updateCap slot' (fst rvb) sb)) (doE a <- reduceZombie (fst rvb) slot' expo;
a <- preemptionPoint;
finaliseSlot' slot' expo
odE)) (\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>?Q5051 rv s rv' rva final sa rvb fc_ret rv'a sb\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb)
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 6. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 7. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 8. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 9. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 10. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5051 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc) (?Q'5051 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b) [SKIP] (doE rv <- cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo);
cutMon (\<lambda>s'. (Inr rv, s') \<in> fst (reduceZombie (fst rvb) slot' expo sc)) (doE a <- preemptionPoint;
finaliseSlot' slot' expo
odE)
odE) (\<acute>ret__int :== (if \<not> expo then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>?Q5051 rv s rv' rva final sa rvb fc_ret rv'a sb\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb)
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 6. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 7. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 8. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 9. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 10. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5051 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc) (?Q'5051 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b) [SKIP] (doE rv <- cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo);
cutMon (\<lambda>s'. (Inr rv, s') \<in> fst (reduceZombie (fst rvb) slot' expo sc)) (doE a <- preemptionPoint;
finaliseSlot' slot' expo
odE)
odE) (\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>?Q5051 rv s rv' rva final sa rvb fc_ret rv'a sb\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb)
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 6. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 7. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 8. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 9. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 10. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (?P5113 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc) (?Q'5051 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b) [] (return ()) (\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI)
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rv'c t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'c t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))) (?d'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rv'c)
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd) (?Q'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c) [SKIP] (doE rv <- cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo);
cutMon (\<lambda>s'. (Inr rv, s') \<in> fst (reduceZombie (fst rvb) slot' expo sc)) (doE a <- preemptionPoint;
finaliseSlot' slot' expo
odE)
odE) (?d'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rv'c)
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>?Q5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (?Q'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc)
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. ?P5113 rv s rv' rva final sa rvb fc_ret rv'a sb a and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'5051 rv s rv' rva final sa rvb fc_ret rv'a sb)
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 10. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. capAligned (fst rvb) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI {s. \<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ret__int_' s = from_bool False}
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rv'c t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'c t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))) (?d'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rv'c)
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd) (?Q'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c) [SKIP] (doE rv <- cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo);
cutMon (\<lambda>s'. (Inr rv, s') \<in> fst (reduceZombie (fst rvb) slot' expo sc)) (doE a <- preemptionPoint;
finaliseSlot' slot' expo
odE)
odE) (?d'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rv'c)
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>?Q5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (?Q'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc)
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 10. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc \<sigma>. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> {s. capAligned (fst rvb) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. ((if \<not> expo then 1 else 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (remainder_C fc_ret) \<and> isZombie cap \<and> capAligned cap \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (capCyclicZombie cap (ptr_val (cte_Ptr slot'))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := from_bool (capCyclicZombie cap (ptr_val (cte_Ptr slot'))), ret__int_' := if from_bool (capCyclicZombie cap (ptr_val (cte_Ptr slot'))) \<noteq> 0 then 1 else 0\<rparr>) \<in> rf_sr \<and> (if from_bool (capCyclicZombie cap (ptr_val (cte_Ptr slot'))) \<noteq> 0 then 1 else 0) = from_bool False)))) \<and> (\<not> (if \<not> expo then 1 else 0) \<noteq> 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s\<lparr>ret__int_' := if \<not> expo then 1 else 0\<rparr>) \<in> rf_sr \<and> (if \<not> expo then 1 else 0) = from_bool False))}
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rv'c t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'c t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))) (?d'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rv'c)
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd) (?Q'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c) [SKIP] (doE rv <- cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo);
cutMon (\<lambda>s'. (Inr rv, s') \<in> fst (reduceZombie (fst rvb) slot' expo sc)) (doE a <- preemptionPoint;
finaliseSlot' slot' expo
odE)
odE) (?d'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rv'c)
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>?Q5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (?Q'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc)
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 10. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv s rv' rva sa a b fc_ret sb sc \<sigma> x. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; (rva, sa) \<in> fst (isFinalCapability rv s); ((a, b), sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable a slot'; isZombie a; ((), sc) \<in> fst (updateCap slot' a sb); ccap_relation a (remainder_C fc_ret); ccap_relation b (finaliseCap_ret_C.cleanupInfo_C fc_ret); capAligned a; (\<sigma>, x) \<in> rf_sr; \<not> expo; \<not> capCyclicZombie a slot'\<rbrakk> \<Longrightarrow> \<exists>cap. ccap_relation cap (remainder_C fc_ret) \<and> isZombie cap \<and> capAligned cap \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (capCyclicZombie cap slot')) \<longrightarrow> (if from_bool (capCyclicZombie cap slot') \<noteq> 0 then 1 else 0) = false)
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rv'c t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'c t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))) (?d'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rv'c)
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd) (?Q'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c) [SKIP] (doE rv <- cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo);
cutMon (\<lambda>s'. (Inr rv, s') \<in> fst (reduceZombie (fst rvb) slot' expo sc)) (doE a <- preemptionPoint;
finaliseSlot' slot' expo
odE)
odE) (?d'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rv'c)
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>?Q5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (?Q'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc)
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 10. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rv'c t t'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'c t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))) (?d'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rv'c)
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd) (?Q'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c) [SKIP] (doE rv <- cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo);
cutMon (\<lambda>s'. (Inr rv, s') \<in> fst (reduceZombie (fst rvb) slot' expo sc)) (doE a <- preemptionPoint;
finaliseSlot' slot' expo
odE)
odE) (?d'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rv'c)
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>?Q5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (?Q'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc)
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 7. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 9. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 10. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd) (?Q'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c) [SKIP] (doE rv <- cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo);
cutMon (\<lambda>s'. (Inr rv, s') \<in> fst (reduceZombie (fst rvb) slot' expo sc)) (doE a <- preemptionPoint;
finaliseSlot' slot' expo
odE)
odE) (IF rv'c \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>?Q5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (?Q'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc)
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 6. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 8. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 9. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 10. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5106 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd) (?Q'5106 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False)) [SKIP] (doE rv <- cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo);
cutMon (\<lambda>s'. (Inr rv, s') \<in> fst (reduceZombie (fst rvb) slot' expo sc)) (doE a <- preemptionPoint;
finaliseSlot' slot' expo
odE)
odE) (\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>?Q5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (?Q'5106 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc)
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 6. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 8. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 9. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 10. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
A total of 13 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c slot. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; capZombieNumber (fst rvb) \<noteq> 0; expo; (slot, sc) \<in> fst (locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1)) sc)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) slot s) (UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool False\<rbrace>) [] (cutMon ((=) sc) (finaliseSlot slot False)) (Call finaliseSlot_'proc)
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> isZombie (fst rvb)
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve) (?Q'5940 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve status) [SKIP] (cutMon (\<lambda>s'. (Inr rve, s') \<in> fst (reduceZombie (fst rvb) slot' expo sc)) (doE a <- preemptionPoint;
finaliseSlot' slot' expo
odE)) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>?Q5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q'5939 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 10. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
A total of 17 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?Q'5940 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q'5939 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (18 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c slot. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; capZombieNumber (fst rvb) \<noteq> 0; expo; (slot, sc) \<in> fst (locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1)) sc)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q6217 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c slot) (?Q'6217 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c slot) [] (cutMon ((=) sc) (finaliseSlot slot False)) (Call finaliseSlot_'proc)
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c slot sd s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; capZombieNumber (fst rvb) \<noteq> 0; expo; (slot, sc) \<in> fst (locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1)) sc); (sd, s'a) \<in> rf_sr; invs' sd \<and> sch_act_simple sd \<and> ex_cte_cap_wp_to' (\<lambda>_. True) slot sd; s'a \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool False\<rbrace>\<rbrakk> \<Longrightarrow> ?Q6217 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c slot sd \<and> s'a \<in> ?Q'6217 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c slot
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> isZombie (fst rvb)
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve) (?Q'5940 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve status) [SKIP] (cutMon (\<lambda>s'. (Inr rve, s') \<in> fst (reduceZombie (fst rvb) slot' expo sc)) (doE a <- preemptionPoint;
finaliseSlot' slot' expo
odE)) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>?Q5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q'5939 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 9. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 10. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
A total of 18 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?Q'5940 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q'5939 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (18 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c slot. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; capZombieNumber (fst rvb) \<noteq> 0; expo; (slot, sc) \<in> fst (locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1)) sc)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot s)) UNIV [SKIP] (cutMon ((=) sc) (finaliseSlot' slot False)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> from_bool False \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot,from_bool False);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c slot sd s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; capZombieNumber (fst rvb) \<noteq> 0; expo; (slot, sc) \<in> fst (locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1)) sc); (sd, s'a) \<in> rf_sr; invs' sd \<and> sch_act_simple sd \<and> ex_cte_cap_wp_to' (\<lambda>_. True) slot sd; s'a \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool False\<rbrace>\<rbrakk> \<Longrightarrow> (invs' sd \<and> sch_act_simple sd \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot sd)) \<and> s'a \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool False\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> isZombie (fst rvb)
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve) (?Q'5940 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve status) [SKIP] (cutMon (\<lambda>s'. (Inr rve, s') \<in> fst (reduceZombie (fst rvb) slot' expo sc)) (doE a <- preemptionPoint;
finaliseSlot' slot' expo
odE)) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>?Q5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q'5939 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 9. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 10. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
A total of 18 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?Q'5940 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q'5939 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (17 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c slot sd s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; capZombieNumber (fst rvb) \<noteq> 0; expo; (slot, sc) \<in> fst (locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1)) sc); (sd, s'a) \<in> rf_sr; invs' sd \<and> sch_act_simple sd \<and> ex_cte_cap_wp_to' (\<lambda>_. True) slot sd; s'a \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool False\<rbrace>\<rbrakk> \<Longrightarrow> (invs' sd \<and> sch_act_simple sd \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot sd)) \<and> s'a \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool False\<rbrace>
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> isZombie (fst rvb)
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve) (?Q'5940 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve status) [SKIP] (cutMon (\<lambda>s'. (Inr rve, s') \<in> fst (reduceZombie (fst rvb) slot' expo sc)) (doE a <- preemptionPoint;
finaliseSlot' slot' expo
odE)) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>?Q5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q'5939 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 10. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
A total of 17 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?Q'5940 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q'5939 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (16 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> isZombie (fst rvb)
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve) (?Q'5940 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve status) [SKIP] (cutMon (\<lambda>s'. (Inr rve, s') \<in> fst (reduceZombie (fst rvb) slot' expo sc)) (doE a <- preemptionPoint;
finaliseSlot' slot' expo
odE)) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>?Q5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q'5939 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 10. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
A total of 16 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?Q'5940 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q'5939 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (15 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve) (?Q'5940 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve status) [SKIP] (cutMon (\<lambda>s'. (Inr rve, s') \<in> fst (reduceZombie (fst rvb) slot' expo sc)) (doE a <- preemptionPoint;
finaliseSlot' slot' expo
odE)) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>?Q5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q'5939 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 10. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?Q'5940 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q'5939 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (15 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve) (?Q'5940 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve status) [SKIP] (cutMon ((=) sd) (doE a <- preemptionPoint;
finaliseSlot' slot' expo
odE)) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>?Q5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q'5939 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 10. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?Q'5940 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q'5939 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (15 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5920 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) rve) (?Q'5940 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (doE rv <- cutMon ((=) sd) preemptionPoint;
cutMon (\<lambda>s'. (Inr rv, s') \<in> fst (preemptionPoint sd)) (finaliseSlot' slot' expo)
odE) (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>?Q5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q'5939 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 10. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?Q'5940 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q'5939 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (15 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q5920 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) rve) (?Q'5940 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (doE a <- preemptionPoint;
cutMon (\<lambda>s'. (Inr a, s') \<in> fst (preemptionPoint sd)) (finaliseSlot' slot' expo)
odE) (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>?Q5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q'5939 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 10. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?Q'5940 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q'5939 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (17 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd rvf status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc); dc rvf (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q6261 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd rvf) (?Q'6288 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve rvf status) [SKIP] (cutMon (\<lambda>s'. (Inr rvf, s') \<in> fst (preemptionPoint sd)) (finaliseSlot' slot' expo)) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc); id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE6261 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd err) (?Q''6286 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc)\<rbrakk> \<Longrightarrow> \<lbrace>?R6281 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) rve\<rbrace> preemptionPoint \<lbrace>?Q6261 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd\<rbrace>, \<lbrace>?QE6261 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>\<lambda>a. invs' and ?R6281 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c a\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {sd. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rve. dc rve (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> ?Q'6290 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd ta rve)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> ?Q''6289 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd ta err))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 10. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
A total of 17 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q'6290 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?Q'6287 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''6289 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?Q''6285 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve t rvf. ?Q'6288 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve rvf (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve. ?Q'6287 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve t err. ?Q''6286 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve. ?Q''6285 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (17 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd rvf status se. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc); dc rvf (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rvf, se) \<in> fst (preemptionPoint sd)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q6261 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd rvf) (?Q'6288 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve rvf status) [SKIP] (cutMon ((=) se) (finaliseSlot' slot' expo)) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc); id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE6261 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd err) (?Q''6286 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc)\<rbrakk> \<Longrightarrow> \<lbrace>?R6281 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) rve\<rbrace> preemptionPoint \<lbrace>?Q6261 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd\<rbrace>, \<lbrace>?QE6261 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>\<lambda>a. invs' and ?R6281 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c a\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {sd. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rve. dc rve (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> ?Q'6290 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd ta rve)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> ?Q''6289 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd ta err))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 10. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
A total of 17 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q'6290 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?Q'6287 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''6289 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?Q''6285 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve t rvf. ?Q'6288 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve rvf (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve. ?Q'6287 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve t err. ?Q''6286 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve. ?Q''6285 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (17 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd rvf status se. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc); dc rvf (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rvf, se) \<in> fst (preemptionPoint sd)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q6261 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) rve (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) sd rvf) (?Q'6288 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve rvf (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (cutMon ((=) se) (finaliseSlot' slot' expo)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc); id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE6261 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd err) (?Q''6286 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc)\<rbrakk> \<Longrightarrow> \<lbrace>?R6281 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) rve\<rbrace> preemptionPoint \<lbrace>?Q6261 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd\<rbrace>, \<lbrace>?QE6261 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>\<lambda>a. invs' and ?R6281 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c a\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {sd. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rve. dc rve (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> ?Q'6290 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd ta rve)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> ?Q''6289 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd ta err))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 10. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
A total of 17 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q'6290 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?Q'6287 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''6289 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?Q''6285 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve t rvf. ?Q'6288 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve rvf (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve. ?Q'6287 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve t err. ?Q''6286 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve. ?Q''6285 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (18 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd rvf status se. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc); dc rvf (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rvf, se) \<in> fst (preemptionPoint sd)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q6261 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) rve (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) sd rvf) (?Q'6288 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve rvf (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (cutMon ((=) se) (finaliseSlot' slot' expo)) (?s6943 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd rvf status se)
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd rvf status se. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc); dc rvf (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rvf, se) \<in> fst (preemptionPoint sd)\<rbrakk> \<Longrightarrow> ?s6943 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd rvf status se = (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP)))))))
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc); id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE6261 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd err) (?Q''6286 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc)\<rbrakk> \<Longrightarrow> \<lbrace>?R6281 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) rve\<rbrace> preemptionPoint \<lbrace>?Q6261 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd\<rbrace>, \<lbrace>?QE6261 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>\<lambda>a. invs' and ?R6281 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c a\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {sd. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rve. dc rve (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> ?Q'6290 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd ta rve)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> ?Q''6289 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd ta err))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 9. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 10. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
A total of 18 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q'6290 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?Q'6287 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''6289 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?Q''6285 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve t rvf. ?Q'6288 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve rvf (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve. ?Q'6287 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve t err. ?Q''6286 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve. ?Q''6285 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (17 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb sc rv'c statusa sd status se. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) false; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; expo \<or> \<not> capCyclicZombie (fst rvb) slot'; isZombie (fst rvb); ((), sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = false; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), se) \<in> fst (preemptionPoint sd)\<rbrakk> \<Longrightarrow> ret__int_'_update (\<lambda>_. if from_bool expo = 0 then 1 else 0) = ret__int_'_update (\<lambda>_. if \<not> expo then 1 else 0)
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc); id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE6261 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd err) (?Q''6286 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc)\<rbrakk> \<Longrightarrow> \<lbrace>?R6281 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) rve\<rbrace> preemptionPoint \<lbrace>\<lambda>a b. invs' b \<and> sch_act_simple b \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' b)\<rbrace>, \<lbrace>?QE6261 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>\<lambda>a. invs' and ?R6281 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c a\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {sd. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> ?Q''6289 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd ta err))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 10. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
A total of 17 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''6289 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?Q''6285 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve t err. ?Q''6286 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve. ?Q''6285 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (16 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc); id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE6261 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve statusa sd err) (?Q''6286 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc)\<rbrakk> \<Longrightarrow> \<lbrace>?R6281 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) rve\<rbrace> preemptionPoint \<lbrace>\<lambda>a b. invs' b \<and> sch_act_simple b \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' b)\<rbrace>, \<lbrace>?QE6261 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>\<lambda>a. invs' and ?R6281 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c a\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {sd. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> ?Q''6289 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd ta err))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 10. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
A total of 16 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''6289 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?Q''6285 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve t err. ?Q''6286 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve. ?Q''6285 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (16 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b sc rv'c statusa sd err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) false; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; expo \<or> \<not> capCyclicZombie (fst rvb) slot'; isZombie (fst rvb); ((), sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = false; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc); rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv'd status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE6261 rv s rv' rva final sa rvb fc_ret (SCAST(32 signed \<rightarrow> 32) false) sb () rv'b sc () false () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) sd err) (?Q''6286 rv s rv' rva final sa rvb fc_ret sb () rv'b sc () () err rv'd status) [SKIP] (throwError err) (\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc)\<rbrakk> \<Longrightarrow> \<lbrace>?R6281 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) rve\<rbrace> preemptionPoint \<lbrace>\<lambda>a b. invs' b \<and> sch_act_simple b \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' b)\<rbrace>, \<lbrace>?QE6261 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>\<lambda>a. invs' and ?R6281 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c a\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {sd. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> ?Q''6289 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd ta err))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 10. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
A total of 16 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''6289 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?Q''6285 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve t err. ?Q''6286 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve. ?Q''6285 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (17 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b sc rv'c statusa sd err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) false; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; expo \<or> \<not> capCyclicZombie (fst rvb) slot'; isZombie (fst rvb); ((), sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = false; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc); rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv'd status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE6261 rv s rv' rva final sa rvb fc_ret (SCAST(32 signed \<rightarrow> 32) false) sb () rv'b sc () false () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) sd err) (?P'6965 rv s rv' rva final sa rvb fc_ret sb () rv'b sc () () err rv'd status) [SKIP] (throwError err) (\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_')
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b sc rv'c statusa sd err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) false; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; expo \<or> \<not> capCyclicZombie (fst rvb) slot'; isZombie (fst rvb); ((), sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = false; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc); rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv'd status\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6964 rv s rv' rva final sa rvb fc_ret sb () rv'b sc () () err rv'd status) \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_' {},UNIV
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc)\<rbrakk> \<Longrightarrow> \<lbrace>?R6281 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) rve\<rbrace> preemptionPoint \<lbrace>\<lambda>a b. invs' b \<and> sch_act_simple b \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' b)\<rbrace>, \<lbrace>?QE6261 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>\<lambda>a. invs' and ?R6281 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c a\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {sd. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> ?P'6969 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd ta err \<inter> ?R'6968 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd ta err))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 10. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
A total of 17 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?P'6969 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?P'6967 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?R'6968 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?R'6966 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve. ?P'6967 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve t err. ?P'6965 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve err (ret__unsigned_long_' t) (errstate t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve. ?R'6966 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve t err. ?R'6964 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve err (ret__unsigned_long_' t) (errstate t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (17 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b sc rv'c statusa sd err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) false; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; expo \<or> \<not> capCyclicZombie (fst rvb) slot'; isZombie (fst rvb); ((), sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = false; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc); rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv'd status\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (throwError err \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) rv (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_' s)}
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b sc rv'c statusa sd err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) false; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; expo \<or> \<not> capCyclicZombie (fst rvb) slot'; isZombie (fst rvb); ((), sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = false; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc); rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv'd status\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6964 rv s rv' rva final sa rvb fc_ret sb () rv'b sc () () err rv'd status) \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_' {},UNIV
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc)\<rbrakk> \<Longrightarrow> \<lbrace>?R6281 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) rve\<rbrace> preemptionPoint \<lbrace>\<lambda>a b. invs' b \<and> sch_act_simple b \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' b)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>\<lambda>a. invs' and ?R6281 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c a\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {sd. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> UNIV \<inter> ?R'6968 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd ta err))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 10. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
A total of 17 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?R'6968 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?R'6966 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve. ?R'6966 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve t err. ?R'6964 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve err (ret__unsigned_long_' t) (errstate t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (17 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b sc rv'c statusa sd err rv'd status \<sigma>. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) false; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; expo \<or> \<not> capCyclicZombie (fst rvb) slot'; isZombie (fst rvb); ((), sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = false; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc); rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv'd status\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (throwError err \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' t, ret___struct_finaliseSlot_ret_C_' := finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' t) (finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) (ret___struct_finaliseSlot_ret_C_' s))), ret__struct_finaliseSlot_ret_C_' := finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' t) (finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) (ret___struct_finaliseSlot_ret_C_' s))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) rv (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_' (s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' t, ret___struct_finaliseSlot_ret_C_' := finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' t) (finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) (ret___struct_finaliseSlot_ret_C_' s))), ret__struct_finaliseSlot_ret_C_' := finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' t) (finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) (ret___struct_finaliseSlot_ret_C_' s))), global_exn_var_' := Return\<rparr>)))}
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b sc rv'c statusa sd err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) false; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; expo \<or> \<not> capCyclicZombie (fst rvb) slot'; isZombie (fst rvb); ((), sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = false; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc); rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv'd status\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6964 rv s rv' rva final sa rvb fc_ret sb () rv'b sc () () err rv'd status) \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_' {},UNIV
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc)\<rbrakk> \<Longrightarrow> \<lbrace>?R6281 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) rve\<rbrace> preemptionPoint \<lbrace>\<lambda>a b. invs' b \<and> sch_act_simple b \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' b)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>\<lambda>a. invs' and ?R6281 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c a\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {sd. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> UNIV \<inter> ?R'6968 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd ta err))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 10. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
A total of 17 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?R'6968 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?R'6966 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve. ?R'6966 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve t err. ?R'6964 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve err (ret__unsigned_long_' t) (errstate t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (16 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rv'b sc rv'c statusa sd err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) false; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; expo \<or> \<not> capCyclicZombie (fst rvb) slot'; isZombie (fst rvb); ((), sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = false; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc); rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv'd status\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6964 rv s rv' rva final sa rvb fc_ret sb () rv'b sc () () err rv'd status) \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_' {},UNIV
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc)\<rbrakk> \<Longrightarrow> \<lbrace>?R6281 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) rve\<rbrace> preemptionPoint \<lbrace>\<lambda>a b. invs' b \<and> sch_act_simple b \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' b)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>\<lambda>a. invs' and ?R6281 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c a\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {sd. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sd\<lparr>globals := globals ta\<rparr>) \<in> UNIV \<inter> ?R'6968 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t rvd ta err))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 10. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
A total of 16 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?R'6968 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t rve. ?R'6966 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (ret__unsigned_long_' t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve. ?R'6966 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve t err. ?R'6964 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd rve err (ret__unsigned_long_' t) (errstate t)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (15 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc)\<rbrakk> \<Longrightarrow> \<lbrace>?R6281 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) rve\<rbrace> preemptionPoint \<lbrace>\<lambda>a b. invs' b \<and> sch_act_simple b \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' b)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>\<lambda>a. invs' and ?R6281 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c a\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 10. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (16 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd f se. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc)\<rbrakk> \<Longrightarrow> (invs' (ksWorkUnitsCompleted_update f se) \<and> sch_act_simple (ksWorkUnitsCompleted_update f se) \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' (ksWorkUnitsCompleted_update f se))) = (invs' se \<and> sch_act_simple se \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' se))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc)\<rbrakk> \<Longrightarrow> irq_state_independent_H (\<lambda>a. invs' a \<and> sch_act_simple a \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a))
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> invs' a \<and> sch_act_simple a \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a))\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 8. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 10. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
A total of 16 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (15 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c rve status sd. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; dc rve (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr rve, sd) \<in> fst (reduceZombie (fst rvb) slot' expo sc)\<rbrakk> \<Longrightarrow> irq_state_independent_H (\<lambda>a. invs' a \<and> sch_act_simple a \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> invs' a \<and> sch_act_simple a \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a))\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 10. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (14 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))));;
(While \<lbrace>\<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> (\<acute>final :== CALL isFinalCapability_'proc(cte_Ptr slot');;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>fc_ret :== CALL finaliseCap_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])),\<acute>final,SCAST(32 signed \<rightarrow> 32) false));;
\<acute>ret__unsigned_long :== CALL capRemovable_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])) (remainder_C \<acute>fc_ret))));;
\<acute>ret__int :== (if \<not> expo then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL capCyclicZombie_'proc(remainder_C \<acute>fc_ret,cte_Ptr slot');;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. finaliseCap_ret_C.cleanupInfo_C \<acute>fc_ret) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL reduceZombie_'proc(cte_Ptr slot',from_bool expo);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. \<acute>status) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))));;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_finaliseSlot_ret_C;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
(return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_';;
Guard DontReach {} SKIP))))))))))
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> invs' a \<and> sch_act_simple a \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a))\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?Q''5937 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 7. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 9. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 10. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
A total of 14 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?Q''5938 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?Q''5937 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (15 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. fst b = from_bool (fst a) \<and> ccap_relation (snd a) (snd b) \<and> cleanup_info_wf' (snd a))) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err) (?P'7067 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) [SKIP] (throwError err) (IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI)
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7066 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI {},UNIV
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> invs' a \<and> sch_act_simple a \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a))\<rbrace>, \<lbrace>?QE5920 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> ?P'7064 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err \<inter> ?R'7063 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 10. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?P'7067 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?P'7064 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False)
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?R'7066 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?R'7063 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (15 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI {},{s. \<exists>(rv, \<sigma>')\<in>fst (throwError err \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) rv (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_' s)}
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7066 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI {},UNIV
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> invs' a \<and> sch_act_simple a \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a))\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'7063 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 10. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?R'7066 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?R'7063 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (15 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status \<sigma>. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (throwError err \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' t, ret___struct_finaliseSlot_ret_C_' := finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' t) (finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) (ret___struct_finaliseSlot_ret_C_' s))), ret__struct_finaliseSlot_ret_C_' := finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' t) (finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) (ret___struct_finaliseSlot_ret_C_' s))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (cintr \<currency> (\<lambda>p pa. fst pa = from_bool (fst p) \<and> ccap_relation (snd p) (snd pa) \<and> cleanup_info_wf' (snd p))) rv (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_' (s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' t, ret___struct_finaliseSlot_ret_C_' := finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' t) (finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) (ret___struct_finaliseSlot_ret_C_' s))), ret__struct_finaliseSlot_ret_C_' := finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. ret__struct_cap_C_' t) (finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) (ret___struct_finaliseSlot_ret_C_' s))), global_exn_var_' := Return\<rparr>))))) \<and> (\<not> rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False)}
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7066 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI {},UNIV
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> invs' a \<and> sch_act_simple a \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a))\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'7063 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 9. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 10. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?R'7066 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?R'7063 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (14 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c err rv'd status. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False; id rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'd) status\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7066 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err rv'd status) IF rv'd \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.status_C_update (\<lambda>_. rv'd) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.success_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_finaliseSlot_ret_C;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
\<acute>ret___struct_finaliseSlot_ret_C :== finaliseSlot_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>ret___struct_finaliseSlot_ret_C;;
return_C ret__struct_finaliseSlot_ret_C_'_update ret___struct_finaliseSlot_ret_C_'
FI {},UNIV
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> invs' a \<and> sch_act_simple a \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a))\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {sd. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sd\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'7063 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b t err))})
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 6. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 7. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 8. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 9. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 10. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
A total of 14 subgoals...
flex-flex pairs:
\<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd t err. ?R'7066 rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rv' rva final sa rvb fc_ret sb rvc rv'b sc rvd. ?R'7063 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd (from_bool False) proof (prove)
goal (13 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?R5932 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> cutMon ((=) sc) (reduceZombie (fst rvb) slot' expo) \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> invs' a \<and> sch_act_simple a \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a))\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and ?R5932 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>(\<^bsup>t\<^esup>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> True) \<and> (\<not> \<^bsup>t\<^esup>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False)\<rbrace>))})
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 6. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 8. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 9. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 10. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc rvd rv'c. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb); rv'c = from_bool False\<rbrakk> \<Longrightarrow> \<lbrace>?P'7179 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc rv'b sc rvd\<rbrace> reduceZombie (fst rvb) slot' expo \<lbrace>\<lambda>rv s. expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s\<rbrace>, -
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> \<lbrace>?R5111 rv s rv' rva final sa rvb fc_ret (from_bool False) sb rvc\<rbrace> return () \<lbrace>\<lambda>a. invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and (\<lambda>b. True \<and> (invs' b \<and> sch_act_simple b \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' b) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' b) \<and> True \<and> (invs' b \<and> sch_act_simple b \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' b) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' b) \<and> (invs' b \<and> sch_act_simple b \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' b) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' b) \<and> ?P'7179 rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc a b)\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>(\<^bsup>t\<^esup>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> True) \<and> (\<not> \<^bsup>t\<^esup>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False)\<rbrace>))})
 4. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and ?R5111 rv s rv' rva final sa rvb fc_ret rv'a sb a\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 6. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 7. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 8. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 9. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 10. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
A total of 13 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb rvc rv'b sc. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot'); dc rvc rv'b; isZombie (fst rvb); (rvc, sc) \<in> fst (updateCap slot' (fst rvb) sb)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool False) ret__int_' (\<lambda>a b. {s. immediate_'_update (\<lambda>_. from_bool expo) (slot_'_update (\<lambda>_. cte_Ptr slot') s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot'\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>(\<^bsup>t\<^esup>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> True) \<and> (\<not> \<^bsup>t\<^esup>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False)\<rbrace>))})
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and (\<lambda>a. True \<and> (invs' a \<and> sch_act_simple a \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' a) \<and> True \<and> (invs' a \<and> sch_act_simple a \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' a) \<and> (invs' a \<and> sch_act_simple a \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' a) \<and> invs' a \<and> sch_act_simple a \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' a))\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 5. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 6. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 7. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 8. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 9. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 10. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a. (\<lambda>a. capAligned (fst rvb)) and (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' and (\<lambda>a. True \<and> (invs' a \<and> sch_act_simple a \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' a) \<and> True \<and> (invs' a \<and> sch_act_simple a \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' a) \<and> (invs' a \<and> sch_act_simple a \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' a) \<and> invs' a \<and> sch_act_simple a \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' a))\<rbrace>
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 3. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 5. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 6. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 7. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 8. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 9. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 10. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = SCAST(32 signed \<rightarrow> 32) false; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; expo \<or> \<not> capCyclicZombie (fst rvb) slot'\<rbrakk> \<Longrightarrow> \<lbrace>?R5056 rv s rv' rva final sa rvb fc_ret ()\<rbrace> updateCap slot' (fst rvb) \<lbrace>\<lambda>a b. invs' b \<and> sch_act_simple b \<and> capAligned (fst rvb) \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' b) \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' b) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) slot' b\<rbrace>
 2. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 3. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a aa. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>aa. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) aa) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and ?R5056 rv s rv' rva final sa rvb fc_ret a) aa)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) aa)\<rbrace>
 4. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 5. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 6. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 7. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 8. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 9. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 10. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret rv'a sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; from_bool rva = final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret); rv'a = from_bool False; (rvb, sb) \<in> fst (global.finaliseCap (cteCap rv) rva False sa); \<not> capRemovable (fst rvb) slot'; \<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot')\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 2. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a b. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>a. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) a) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' a \<and> valid_cap' (fst rvb) a \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) slot' (cteCaps_of a)) slot' a \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r a) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p a \<and> bound_tcb_at' ((=) None) p a \<and> obj_at' (Not \<circ> tcbQueued) p a \<and> (\<forall>pr. p \<notin> set (ksReadyQueues a pr)))) slot' a) \<and> sch_act_simple a \<and> capAligned (fst rvb) \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a \<and> cte_wp_at' (\<lambda>cte. slot' \<notin> cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a)) slot' a) \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a \<and> cte_wp_at' (\<lambda>cte. slot' \<notin> cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a)) slot' a) \<and> (slot' = slot' \<longrightarrow> cte_wp_at' ((\<lambda>a. cteCap a = fst rvb) \<circ> cteCap_update (K (fst rvb))) slot' a) \<and> (slot' \<noteq> slot' \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = fst rvb) slot' a))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) b)\<rbrace>
 3. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 4. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 5. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 6. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 7. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 8. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 9. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> \<lbrace>?R2758 rv s rv' rva final sa rvb\<rbrace> return () \<lbrace>\<lambda>a b. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>a. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) a) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' a \<and> valid_cap' (fst rvb) a \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) slot' (cteCaps_of a)) slot' a \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r a) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p a \<and> bound_tcb_at' ((=) None) p a \<and> obj_at' (Not \<circ> tcbQueued) p a \<and> (\<forall>pr. p \<notin> set (ksReadyQueues a pr)))) slot' a) \<and> sch_act_simple a \<and> capAligned (fst rvb) \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a \<and> cte_wp_at' (\<lambda>cte. slot' \<notin> cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a)) slot' a) \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a \<and> cte_wp_at' (\<lambda>cte. slot' \<notin> cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a)) slot' a) \<and> (slot' = slot' \<longrightarrow> cte_wp_at' ((\<lambda>a. cteCap a = fst rvb) \<circ> cteCap_update (K (fst rvb))) slot' a) \<and> (slot' \<noteq> slot' \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = fst rvb) slot' a))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) b)\<rbrace>
 2. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 3. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and ?R2758 rv s rv' rva final sa rvb\<rbrace>
 4. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 5. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 6. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 7. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 8. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv s rv' rva final sa rvb fc_ret. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ccap_relation (fst rvb) (remainder_C fc_ret) \<and> ccap_relation (snd rvb) (finaliseCap_ret_C.cleanupInfo_C fc_ret)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capRemovable (fst rvb) slot')) ret__unsigned_long_' (\<lambda>a b. {s. (capRemovable (fst rvb) slot' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> s \<in> {s. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> s \<in> UNIV) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>True\<rbrace>)})
 2. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and (\<lambda>a. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>a. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) a) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' a \<and> valid_cap' (fst rvb) a \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) slot' (cteCaps_of a)) slot' a \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r a) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p a \<and> bound_tcb_at' ((=) None) p a \<and> obj_at' (Not \<circ> tcbQueued) p a \<and> (\<forall>pr. p \<notin> set (ksReadyQueues a pr)))) slot' a) \<and> sch_act_simple a \<and> capAligned (fst rvb) \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a \<and> cte_wp_at' (\<lambda>cte. slot' \<notin> cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a)) slot' a) \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a \<and> cte_wp_at' (\<lambda>cte. slot' \<notin> cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a)) slot' a) \<and> (slot' = slot' \<longrightarrow> cte_wp_at' ((\<lambda>a. cteCap a = fst rvb) \<circ> cteCap_update (K (fst rvb))) slot' a) \<and> (slot' \<noteq> slot' \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = fst rvb) slot' a))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) a))\<rbrace>
 3. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 4. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 6. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 7. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb. (\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and (\<lambda>a. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>a. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) a) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' a \<and> valid_cap' (fst rvb) a \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) slot' (cteCaps_of a)) slot' a \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r a) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p a \<and> bound_tcb_at' ((=) None) p a \<and> obj_at' (Not \<circ> tcbQueued) p a \<and> (\<forall>pr. p \<notin> set (ksReadyQueues a pr)))) slot' a) \<and> sch_act_simple a \<and> capAligned (fst rvb) \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a \<and> cte_wp_at' (\<lambda>cte. slot' \<notin> cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a)) slot' a) \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a \<and> cte_wp_at' (\<lambda>cte. slot' \<notin> cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a)) slot' a) \<and> (slot' = slot' \<longrightarrow> cte_wp_at' ((\<lambda>a. cteCap a = fst rvb) \<circ> cteCap_update (K (fst rvb))) slot' a) \<and> (slot' \<noteq> slot' \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = fst rvb) slot' a))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) a))\<rbrace>
 2. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 3. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 4. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 5. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 6. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?R1877 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>?Q7236 rv s rv' rva final sa\<rbrace>
 2. \<And>rv s rv' rva final sa rvb sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); ?Q7236 rv s rv' rva final sa rvb sb\<rbrakk> \<Longrightarrow> ((\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and (\<lambda>a. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>a. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) a) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' a \<and> valid_cap' (fst rvb) a \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) slot' (cteCaps_of a)) slot' a \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r a) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p a \<and> bound_tcb_at' ((=) None) p a \<and> obj_at' (Not \<circ> tcbQueued) p a \<and> (\<forall>pr. p \<notin> set (ksReadyQueues a pr)))) slot' a) \<and> sch_act_simple a \<and> capAligned (fst rvb) \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a \<and> cte_wp_at' (\<lambda>cte. slot' \<notin> cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a)) slot' a) \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a \<and> cte_wp_at' (\<lambda>cte. slot' \<notin> cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a)) slot' a) \<and> (slot' = slot' \<longrightarrow> cte_wp_at' ((\<lambda>a. cteCap a = fst rvb) \<circ> cteCap_update (K (fst rvb))) slot' a) \<and> (slot' \<noteq> slot' \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = fst rvb) slot' a))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) a))) sb
 3. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and ?R1877 rv s rv' rva final sa) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 4. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 6. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 7. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7239 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>fin s. invs' s \<and> sch_act_simple s \<and> valid_cap' (fst fin) s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' s\<rbrace>
 2. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?P'7239 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>?Q'7239 rv s rv' rva final sa\<rbrace>
 3. \<And>rv s rv' rva final sa rvb sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (invs' sb \<and> sch_act_simple sb \<and> valid_cap' (fst rvb) sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' sb) \<and> ?Q'7239 rv s rv' rva final sa rvb sb\<rbrakk> \<Longrightarrow> ((\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and (\<lambda>a. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>a. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) a) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' a \<and> valid_cap' (fst rvb) a \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) slot' (cteCaps_of a)) slot' a \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r a) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p a \<and> bound_tcb_at' ((=) None) p a \<and> obj_at' (Not \<circ> tcbQueued) p a \<and> (\<forall>pr. p \<notin> set (ksReadyQueues a pr)))) slot' a) \<and> sch_act_simple a \<and> capAligned (fst rvb) \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a \<and> cte_wp_at' (\<lambda>cte. slot' \<notin> cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a)) slot' a) \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a \<and> cte_wp_at' (\<lambda>cte. slot' \<notin> cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a)) slot' a) \<and> (slot' = slot' \<longrightarrow> cte_wp_at' ((\<lambda>a. cteCap a = fst rvb) \<circ> cteCap_update (K (fst rvb))) slot' a) \<and> (slot' \<noteq> slot' \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = fst rvb) slot' a))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) a))) sb
 4. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and (\<lambda>sb. ?P7239 rv s rv' rva final sa sb \<and> ?P'7239 rv s rv' rva final sa sb)) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 5. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 6. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 7. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 8. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?P'7239 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>?Q'7239 rv s rv' rva final sa\<rbrace>
 2. \<And>rv s rv' rva final sa rvb sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (invs' sb \<and> sch_act_simple sb \<and> valid_cap' (fst rvb) sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' sb) \<and> ?Q'7239 rv s rv' rva final sa rvb sb\<rbrakk> \<Longrightarrow> ((\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and (\<lambda>a. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>a. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) a) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' a \<and> valid_cap' (fst rvb) a \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) slot' (cteCaps_of a)) slot' a \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r a) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p a \<and> bound_tcb_at' ((=) None) p a \<and> obj_at' (Not \<circ> tcbQueued) p a \<and> (\<forall>pr. p \<notin> set (ksReadyQueues a pr)))) slot' a) \<and> sch_act_simple a \<and> capAligned (fst rvb) \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a \<and> cte_wp_at' (\<lambda>cte. slot' \<notin> cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a)) slot' a) \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a \<and> cte_wp_at' (\<lambda>cte. slot' \<notin> cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a)) slot' a) \<and> (slot' = slot' \<longrightarrow> cte_wp_at' ((\<lambda>a. cteCap a = fst rvb) \<circ> cteCap_update (K (fst rvb))) slot' a) \<and> (slot' \<noteq> slot' \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = fst rvb) slot' a))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) a))) sb
 3. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and (\<lambda>sb. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot') sb \<and> sch_act_simple sb \<and> valid_cap' (cteCap rv) sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' sb) \<and> ?P'7239 rv s rv' rva final sa sb)) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 4. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 6. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 7. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7254 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>?Q7254 rv s rv' rva final sa\<rbrace>
 2. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?P'7254 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>?Q'7254 rv s rv' rva final sa\<rbrace>
 3. \<And>rv s rv' rva final sa rvb sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (invs' sb \<and> sch_act_simple sb \<and> valid_cap' (fst rvb) sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' sb) \<and> ?Q7254 rv s rv' rva final sa rvb sb \<and> ?Q'7254 rv s rv' rva final sa rvb sb\<rbrakk> \<Longrightarrow> ((\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and (\<lambda>a. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>a. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) a) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' a \<and> valid_cap' (fst rvb) a \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) slot' (cteCaps_of a)) slot' a \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r a) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p a \<and> bound_tcb_at' ((=) None) p a \<and> obj_at' (Not \<circ> tcbQueued) p a \<and> (\<forall>pr. p \<notin> set (ksReadyQueues a pr)))) slot' a) \<and> sch_act_simple a \<and> capAligned (fst rvb) \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a \<and> cte_wp_at' (\<lambda>cte. slot' \<notin> cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a)) slot' a) \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a \<and> cte_wp_at' (\<lambda>cte. slot' \<notin> cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a)) slot' a) \<and> (slot' = slot' \<longrightarrow> cte_wp_at' ((\<lambda>a. cteCap a = fst rvb) \<circ> cteCap_update (K (fst rvb))) slot' a) \<and> (slot' \<noteq> slot' \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = fst rvb) slot' a))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) a))) sb
 4. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and (\<lambda>sb. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot') sb \<and> sch_act_simple sb \<and> valid_cap' (cteCap rv) sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' sb) \<and> ?P7254 rv s rv' rva final sa sb \<and> ?P'7254 rv s rv' rva final sa sb)) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 5. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 6. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 7. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 8. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv s rv' rva final sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s)\<rbrakk> \<Longrightarrow> \<lbrace>?P'7254 rv s rv' rva final sa\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>?Q'7254 rv s rv' rva final sa\<rbrace>
 2. \<And>rv s rv' rva final sa rvb sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (invs' sb \<and> sch_act_simple sb \<and> valid_cap' (fst rvb) sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' sb) \<and> (fst rvb \<noteq> capability.NullCap \<longrightarrow> cte_refs' (fst rvb) = cte_refs' (cteCap rv)) \<and> ?Q'7254 rv s rv' rva final sa rvb sb\<rbrakk> \<Longrightarrow> ((\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and (\<lambda>a. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>a. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) a) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' a \<and> valid_cap' (fst rvb) a \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) slot' (cteCaps_of a)) slot' a \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r a) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p a \<and> bound_tcb_at' ((=) None) p a \<and> obj_at' (Not \<circ> tcbQueued) p a \<and> (\<forall>pr. p \<notin> set (ksReadyQueues a pr)))) slot' a) \<and> sch_act_simple a \<and> capAligned (fst rvb) \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a \<and> cte_wp_at' (\<lambda>cte. slot' \<notin> cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a)) slot' a) \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a \<and> cte_wp_at' (\<lambda>cte. slot' \<notin> cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a)) slot' a) \<and> (slot' = slot' \<longrightarrow> cte_wp_at' ((\<lambda>a. cteCap a = fst rvb) \<circ> cteCap_update (K (fst rvb))) slot' a) \<and> (slot' \<noteq> slot' \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = fst rvb) slot' a))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) a))) sb
 3. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and (\<lambda>sb. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot') sb \<and> sch_act_simple sb \<and> valid_cap' (cteCap rv) sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' sb) \<and> valid_cap' (cteCap rv) sb \<and> ?P'7254 rv s rv' rva final sa sb)) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 4. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 6. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 7. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>rv s rv' rva final sa rvb sb. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (invs' sb \<and> sch_act_simple sb \<and> valid_cap' (fst rvb) sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' sb) \<and> (fst rvb \<noteq> capability.NullCap \<longrightarrow> cte_refs' (fst rvb) = cte_refs' (cteCap rv)) \<and> (isNullCap (fst rvb) \<and> removeable' slot' sb (cteCap rv) \<and> (snd rvb \<noteq> capability.NullCap \<longrightarrow> snd rvb = cteCap rv \<and> cap_has_cleanup' (cteCap rv) \<and> isFinal (cteCap rv) slot' (cteCaps_of sb)) \<or> isZombie (fst rvb) \<and> snd rvb = capability.NullCap \<and> isFinal (cteCap rv) slot' (cteCaps_of sb) \<and> capClass (cteCap rv) = capClass (fst rvb) \<and> global.capUntypedPtr (fst rvb) = global.capUntypedPtr (cteCap rv) \<and> capBits (fst rvb) = capBits (cteCap rv) \<and> capRange (fst rvb) = capRange (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sb \<and> obj_at' (Not \<circ> tcbQueued) p sb \<and> bound_tcb_at' ((=) None) p sb \<and> (\<forall>pr. p \<notin> set (ksReadyQueues sb pr))))\<rbrakk> \<Longrightarrow> ((\<lambda>s. capAligned (fst rvb) \<and> (isZombie (fst rvb) \<or> fst rvb = capability.NullCap)) and (\<lambda>a. (capRemovable (fst rvb) slot' \<longrightarrow> (case snd rvb of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable (fst rvb) slot' \<longrightarrow> ((\<lambda>a. (\<not> expo \<and> capCyclicZombie (fst rvb) slot' \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. capAligned (fst rvb) \<and> True)) a) \<and> (\<not> (\<not> expo \<and> capCyclicZombie (fst rvb) slot') \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' a \<and> valid_cap' (fst rvb) a \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) slot' (cteCaps_of a)) slot' a \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r a) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p a \<and> bound_tcb_at' ((=) None) p a \<and> obj_at' (Not \<circ> tcbQueued) p a \<and> (\<forall>pr. p \<notin> set (ksReadyQueues a pr)))) slot' a) \<and> sch_act_simple a \<and> capAligned (fst rvb) \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a \<and> cte_wp_at' (\<lambda>cte. slot' \<notin> cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a)) slot' a) \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' a \<and> cte_wp_at' (\<lambda>cte. slot' \<notin> cte_refs' (cteCap cte) (irq_node' a) - cte_refs' (fst rvb) (irq_node' a)) slot' a) \<and> (slot' = slot' \<longrightarrow> cte_wp_at' ((\<lambda>a. cteCap a = fst rvb) \<circ> cteCap_update (K (fst rvb))) slot' a) \<and> (slot' \<noteq> slot' \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = fst rvb) slot' a))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) a))) sb
 2. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and (\<lambda>s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot') s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' s) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s)) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 3. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 4. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 5. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 6. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>rv s rv' rva sa a b sb cte. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; (rva, sa) \<in> fst (isFinalCapability rv s); invs' sb; sch_act_simple sb; valid_cap' a sb; expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb; a \<noteq> capability.NullCap \<longrightarrow> cte_refs' a = cte_refs' (cteCap rv); a = capability.NullCap \<and> removeable' slot' sb (cteCap rv) \<and> (b \<noteq> capability.NullCap \<longrightarrow> b = cteCap rv \<and> cap_has_cleanup' (cteCap rv) \<and> isFinal (cteCap rv) slot' (cteCaps_of sb)) \<or> isZombie a \<and> b = capability.NullCap \<and> isFinal (cteCap rv) slot' (cteCaps_of sb) \<and> capClass (cteCap rv) = capClass a \<and> global.capUntypedPtr a = global.capUntypedPtr (cteCap rv) \<and> capBits a = capBits (cteCap rv) \<and> capRange a = capRange (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sb \<and> obj_at' (Not \<circ> tcbQueued) p sb \<and> bound_tcb_at' ((=) None) p sb \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sb (a, b)))); ctes_of sb slot' = Some cte; cteCap cte = cteCap rv\<rbrakk> \<Longrightarrow> capAligned a \<and> (isZombie a \<or> a = capability.NullCap) \<and> (capRemovable a slot' \<longrightarrow> (case b of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable a slot' \<longrightarrow> (\<not> expo \<and> capCyclicZombie a slot' \<longrightarrow> capAligned a) \<and> (expo \<longrightarrow> isFinal (cteCap rv) slot' (cteCaps_of sb) \<and> capClass (cteCap rv) = PhysicalClass \<and> global.capUntypedPtr (cteCap rv) = global.capUntypedPtr a \<and> capBits (cteCap rv) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap rv) (irq_node' sb) - cte_refs' a (irq_node' sb). \<exists>cte. ctes_of sb r = Some cte \<and> cteCap cte = capability.NullCap) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> \<not> isUntypedCap (cteCap rv) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sb \<and> bound_tcb_at' ((=) None) p sb \<and> obj_at' (\<lambda>a. \<not> tcbQueued a) p sb \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sb (a, b)))) \<and> capAligned a) \<and> (\<not> capCyclicZombie a slot' \<longrightarrow> isFinal (cteCap rv) slot' (cteCaps_of sb) \<and> capClass (cteCap rv) = PhysicalClass \<and> global.capUntypedPtr (cteCap rv) = global.capUntypedPtr a \<and> capBits (cteCap rv) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap rv) (irq_node' sb) - cte_refs' a (irq_node' sb). \<exists>cte. ctes_of sb r = Some cte \<and> cteCap cte = capability.NullCap) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> \<not> isUntypedCap (cteCap rv) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sb \<and> bound_tcb_at' ((=) None) p sb \<and> obj_at' (\<lambda>a. \<not> tcbQueued a) p sb \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sb (a, b)))) \<and> capAligned a \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb \<and> (slot' \<in> cte_refs' (cteCap rv) (irq_node' sb) \<longrightarrow> slot' \<in> cte_refs' a (irq_node' sb))) \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb \<and> (slot' \<in> cte_refs' (cteCap rv) (irq_node' sb) \<longrightarrow> slot' \<in> cte_refs' a (irq_node' sb)))))
 2. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and (\<lambda>s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot') s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' s) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s)) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 3. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 4. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 5. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 6. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv s rv' rva sa a b sb cte. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; (rva, sa) \<in> fst (isFinalCapability rv s); invs' sb; sch_act_simple sb; valid_cap' a sb; expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb; a \<noteq> capability.NullCap \<longrightarrow> cte_refs' a = cte_refs' (cteCap rv); ctes_of sb slot' = Some cte; cteCap cte = cteCap rv; a = capability.NullCap \<and> removeable' slot' sb (cteCap rv) \<and> (b \<noteq> capability.NullCap \<longrightarrow> b = cteCap rv \<and> cap_has_cleanup' (cteCap rv) \<and> isFinal (cteCap rv) slot' (cteCaps_of sb))\<rbrakk> \<Longrightarrow> capAligned a \<and> (isZombie a \<or> a = capability.NullCap) \<and> (capRemovable a slot' \<longrightarrow> (case b of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable a slot' \<longrightarrow> (\<not> expo \<and> capCyclicZombie a slot' \<longrightarrow> capAligned a) \<and> (expo \<longrightarrow> isFinal (cteCap rv) slot' (cteCaps_of sb) \<and> capClass (cteCap rv) = PhysicalClass \<and> global.capUntypedPtr (cteCap rv) = global.capUntypedPtr a \<and> capBits (cteCap rv) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap rv) (irq_node' sb) - cte_refs' a (irq_node' sb). \<exists>cte. ctes_of sb r = Some cte \<and> cteCap cte = capability.NullCap) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> \<not> isUntypedCap (cteCap rv) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sb \<and> bound_tcb_at' ((=) None) p sb \<and> obj_at' (\<lambda>a. \<not> tcbQueued a) p sb \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sb (a, b)))) \<and> capAligned a) \<and> (\<not> capCyclicZombie a slot' \<longrightarrow> isFinal (cteCap rv) slot' (cteCaps_of sb) \<and> capClass (cteCap rv) = PhysicalClass \<and> global.capUntypedPtr (cteCap rv) = global.capUntypedPtr a \<and> capBits (cteCap rv) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap rv) (irq_node' sb) - cte_refs' a (irq_node' sb). \<exists>cte. ctes_of sb r = Some cte \<and> cteCap cte = capability.NullCap) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> \<not> isUntypedCap (cteCap rv) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sb \<and> bound_tcb_at' ((=) None) p sb \<and> obj_at' (\<lambda>a. \<not> tcbQueued a) p sb \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sb (a, b)))) \<and> capAligned a \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb \<and> (slot' \<in> cte_refs' (cteCap rv) (irq_node' sb) \<longrightarrow> slot' \<in> cte_refs' a (irq_node' sb))) \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb \<and> (slot' \<in> cte_refs' (cteCap rv) (irq_node' sb) \<longrightarrow> slot' \<in> cte_refs' a (irq_node' sb)))))
 2. \<And>rv s rv' rva sa a b sb cte. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; (rva, sa) \<in> fst (isFinalCapability rv s); invs' sb; sch_act_simple sb; valid_cap' a sb; expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb; a \<noteq> capability.NullCap \<longrightarrow> cte_refs' a = cte_refs' (cteCap rv); ctes_of sb slot' = Some cte; cteCap cte = cteCap rv; isZombie a \<and> b = capability.NullCap \<and> isFinal (cteCap rv) slot' (cteCaps_of sb) \<and> capClass (cteCap rv) = capClass a \<and> global.capUntypedPtr a = global.capUntypedPtr (cteCap rv) \<and> capBits a = capBits (cteCap rv) \<and> capRange a = capRange (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sb \<and> obj_at' (Not \<circ> tcbQueued) p sb \<and> bound_tcb_at' ((=) None) p sb \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sb (a, b))))\<rbrakk> \<Longrightarrow> capAligned a \<and> (isZombie a \<or> a = capability.NullCap) \<and> (capRemovable a slot' \<longrightarrow> (case b of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable a slot' \<longrightarrow> (\<not> expo \<and> capCyclicZombie a slot' \<longrightarrow> capAligned a) \<and> (expo \<longrightarrow> isFinal (cteCap rv) slot' (cteCaps_of sb) \<and> capClass (cteCap rv) = PhysicalClass \<and> global.capUntypedPtr (cteCap rv) = global.capUntypedPtr a \<and> capBits (cteCap rv) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap rv) (irq_node' sb) - cte_refs' a (irq_node' sb). \<exists>cte. ctes_of sb r = Some cte \<and> cteCap cte = capability.NullCap) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> \<not> isUntypedCap (cteCap rv) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sb \<and> bound_tcb_at' ((=) None) p sb \<and> obj_at' (\<lambda>a. \<not> tcbQueued a) p sb \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sb (a, b)))) \<and> capAligned a) \<and> (\<not> capCyclicZombie a slot' \<longrightarrow> isFinal (cteCap rv) slot' (cteCaps_of sb) \<and> capClass (cteCap rv) = PhysicalClass \<and> global.capUntypedPtr (cteCap rv) = global.capUntypedPtr a \<and> capBits (cteCap rv) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap rv) (irq_node' sb) - cte_refs' a (irq_node' sb). \<exists>cte. ctes_of sb r = Some cte \<and> cteCap cte = capability.NullCap) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> \<not> isUntypedCap (cteCap rv) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sb \<and> bound_tcb_at' ((=) None) p sb \<and> obj_at' (\<lambda>a. \<not> tcbQueued a) p sb \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sb (a, b)))) \<and> capAligned a \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb \<and> (slot' \<in> cte_refs' (cteCap rv) (irq_node' sb) \<longrightarrow> slot' \<in> cte_refs' a (irq_node' sb))) \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb \<and> (slot' \<in> cte_refs' (cteCap rv) (irq_node' sb) \<longrightarrow> slot' \<in> cte_refs' a (irq_node' sb)))))
 3. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and (\<lambda>s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot') s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' s) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s)) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 4. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 6. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 7. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv s rv' rva sa sb cte x4. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; (rva, sa) \<in> fst (isFinalCapability rv s); invs' sb; sch_act_simple sb; expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb; ctes_of sb slot' = Some cte; cteCap cte = capability.IRQHandlerCap x4; cteCap rv = capability.IRQHandlerCap x4; removeable' slot' sb (capability.IRQHandlerCap x4); isFinal (capability.IRQHandlerCap x4) slot' (cteCaps_of sb)\<rbrakk> \<Longrightarrow> UCAST(10 \<rightarrow> 32) x4 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ
 2. \<And>rv s rv' rva sa a b sb cte. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; (rva, sa) \<in> fst (isFinalCapability rv s); invs' sb; sch_act_simple sb; valid_cap' a sb; expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb; a \<noteq> capability.NullCap \<longrightarrow> cte_refs' a = cte_refs' (cteCap rv); ctes_of sb slot' = Some cte; cteCap cte = cteCap rv; isZombie a \<and> b = capability.NullCap \<and> isFinal (cteCap rv) slot' (cteCaps_of sb) \<and> capClass (cteCap rv) = capClass a \<and> global.capUntypedPtr a = global.capUntypedPtr (cteCap rv) \<and> capBits a = capBits (cteCap rv) \<and> capRange a = capRange (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sb \<and> obj_at' (Not \<circ> tcbQueued) p sb \<and> bound_tcb_at' ((=) None) p sb \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sb (a, b))))\<rbrakk> \<Longrightarrow> capAligned a \<and> (isZombie a \<or> a = capability.NullCap) \<and> (capRemovable a slot' \<longrightarrow> (case b of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable a slot' \<longrightarrow> (\<not> expo \<and> capCyclicZombie a slot' \<longrightarrow> capAligned a) \<and> (expo \<longrightarrow> isFinal (cteCap rv) slot' (cteCaps_of sb) \<and> capClass (cteCap rv) = PhysicalClass \<and> global.capUntypedPtr (cteCap rv) = global.capUntypedPtr a \<and> capBits (cteCap rv) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap rv) (irq_node' sb) - cte_refs' a (irq_node' sb). \<exists>cte. ctes_of sb r = Some cte \<and> cteCap cte = capability.NullCap) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> \<not> isUntypedCap (cteCap rv) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sb \<and> bound_tcb_at' ((=) None) p sb \<and> obj_at' (\<lambda>a. \<not> tcbQueued a) p sb \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sb (a, b)))) \<and> capAligned a) \<and> (\<not> capCyclicZombie a slot' \<longrightarrow> isFinal (cteCap rv) slot' (cteCaps_of sb) \<and> capClass (cteCap rv) = PhysicalClass \<and> global.capUntypedPtr (cteCap rv) = global.capUntypedPtr a \<and> capBits (cteCap rv) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap rv) (irq_node' sb) - cte_refs' a (irq_node' sb). \<exists>cte. ctes_of sb r = Some cte \<and> cteCap cte = capability.NullCap) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> \<not> isUntypedCap (cteCap rv) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sb \<and> bound_tcb_at' ((=) None) p sb \<and> obj_at' (\<lambda>a. \<not> tcbQueued a) p sb \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sb (a, b)))) \<and> capAligned a \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb \<and> (slot' \<in> cte_refs' (cteCap rv) (irq_node' sb) \<longrightarrow> slot' \<in> cte_refs' a (irq_node' sb))) \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb \<and> (slot' \<in> cte_refs' (cteCap rv) (irq_node' sb) \<longrightarrow> slot' \<in> cte_refs' a (irq_node' sb)))))
 3. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and (\<lambda>s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot') s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' s) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s)) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 4. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 6. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 7. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>rv s rv' rva sa a b sb cte. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; (rva, sa) \<in> fst (isFinalCapability rv s); invs' sb; sch_act_simple sb; valid_cap' a sb; expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb; a \<noteq> capability.NullCap \<longrightarrow> cte_refs' a = cte_refs' (cteCap rv); ctes_of sb slot' = Some cte; cteCap cte = cteCap rv; isZombie a \<and> b = capability.NullCap \<and> isFinal (cteCap rv) slot' (cteCaps_of sb) \<and> capClass (cteCap rv) = capClass a \<and> global.capUntypedPtr a = global.capUntypedPtr (cteCap rv) \<and> capBits a = capBits (cteCap rv) \<and> capRange a = capRange (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sb \<and> obj_at' (Not \<circ> tcbQueued) p sb \<and> bound_tcb_at' ((=) None) p sb \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sb (a, b))))\<rbrakk> \<Longrightarrow> capAligned a \<and> (isZombie a \<or> a = capability.NullCap) \<and> (capRemovable a slot' \<longrightarrow> (case b of capability.IRQHandlerCap irq \<Rightarrow> UCAST(10 \<rightarrow> 32) irq \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ | _ \<Rightarrow> True)) \<and> (\<not> capRemovable a slot' \<longrightarrow> (\<not> expo \<and> capCyclicZombie a slot' \<longrightarrow> capAligned a) \<and> (expo \<longrightarrow> isFinal (cteCap rv) slot' (cteCaps_of sb) \<and> capClass (cteCap rv) = PhysicalClass \<and> global.capUntypedPtr (cteCap rv) = global.capUntypedPtr a \<and> capBits (cteCap rv) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap rv) (irq_node' sb) - cte_refs' a (irq_node' sb). \<exists>cte. ctes_of sb r = Some cte \<and> cteCap cte = capability.NullCap) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> \<not> isUntypedCap (cteCap rv) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sb \<and> bound_tcb_at' ((=) None) p sb \<and> obj_at' (\<lambda>a. \<not> tcbQueued a) p sb \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sb (a, b)))) \<and> capAligned a) \<and> (\<not> capCyclicZombie a slot' \<longrightarrow> isFinal (cteCap rv) slot' (cteCaps_of sb) \<and> capClass (cteCap rv) = PhysicalClass \<and> global.capUntypedPtr (cteCap rv) = global.capUntypedPtr a \<and> capBits (cteCap rv) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap rv) (irq_node' sb) - cte_refs' a (irq_node' sb). \<exists>cte. ctes_of sb r = Some cte \<and> cteCap cte = capability.NullCap) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> \<not> isUntypedCap (cteCap rv) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sb \<and> bound_tcb_at' ((=) None) p sb \<and> obj_at' (\<lambda>a. \<not> tcbQueued a) p sb \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sb (a, b)))) \<and> capAligned a \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb \<and> (slot' \<in> cte_refs' (cteCap rv) (irq_node' sb) \<longrightarrow> slot' \<in> cte_refs' a (irq_node' sb))) \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb \<and> (slot' \<in> cte_refs' (cteCap rv) (irq_node' sb) \<longrightarrow> slot' \<in> cte_refs' a (irq_node' sb)))))
 2. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and (\<lambda>s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot') s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' s) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s)) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 3. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 4. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 5. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 6. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>rv s rv' rva sa sb cte bits num. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; (rva, sa) \<in> fst (isFinalCapability rv s); invs' sb; sch_act_simple sb; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sb; expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); ctes_of sb slot' = Some cte; cteCap cte = cteCap rv; isFinal (cteCap rv) slot' (cteCaps_of sb); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sb \<and> obj_at' (Not \<circ> tcbQueued) p sb \<and> bound_tcb_at' ((=) None) p sb \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sb (a, b)))\<rbrakk> \<Longrightarrow> capAligned (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<and> (\<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) slot' \<longrightarrow> (\<not> expo \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) slot' \<longrightarrow> capAligned (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) \<and> (expo \<longrightarrow> final_matters' (cteCap rv) \<and> \<not> isUntypedCap (cteCap rv) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). obj_at' (\<lambda>a. \<not> tcbQueued a) p sb) \<and> capAligned (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) slot' \<longrightarrow> final_matters' (cteCap rv) \<and> \<not> isUntypedCap (cteCap rv) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). obj_at' (\<lambda>a. \<not> tcbQueued a) p sb) \<and> capAligned (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb)))
 2. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and (\<lambda>s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot') s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' s) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s)) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 3. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 4. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 5. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 6. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(rv_, s_) \<in> fst (getCTE slot' s'); rv'_ \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv_ \<noteq> capability.NullCap; (rva_, sa_) \<in> fst (isFinalCapability rv_ s_); invs' sb_; sch_act_simple sb_; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv_)) bits_ num_) sb_; expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb_; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv_)) bits_ num_) = cte_refs' (cteCap rv_); ctes_of sb_ slot' = Some cte_; cteCap cte_ = cteCap rv_; isFinal (cteCap rv_) slot' (cteCaps_of sb_); capClass (cteCap rv_) = PhysicalClass; zBits bits_ = capBits (cteCap rv_); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv_)) bits_ num_) = capRange (cteCap rv_); isThreadCap (cteCap rv_) \<or> isCNodeCap (cteCap rv_) \<or> isZombie (cteCap rv_); \<forall>p\<in>threadCapRefs (cteCap rv_). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sb_ \<and> obj_at' (Not \<circ> tcbQueued) p sb_ \<and> bound_tcb_at' ((=) None) p sb_ \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sb_ (a, b)))\<rbrakk> \<Longrightarrow> capAligned (capability.Zombie (global.capUntypedPtr (cteCap rv_)) bits_ num_) \<and> (\<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv_)) bits_ num_) slot' \<longrightarrow> (\<not> expo \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv_)) bits_ num_) slot' \<longrightarrow> capAligned (capability.Zombie (global.capUntypedPtr (cteCap rv_)) bits_ num_)) \<and> (expo \<longrightarrow> final_matters' (cteCap rv_) \<and> \<not> isUntypedCap (cteCap rv_) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv_). obj_at' (\<lambda>a. \<not> tcbQueued a) p sb_) \<and> capAligned (capability.Zombie (global.capUntypedPtr (cteCap rv_)) bits_ num_)) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv_)) bits_ num_) slot' \<longrightarrow> final_matters' (cteCap rv_) \<and> \<not> isUntypedCap (cteCap rv_) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv_). obj_at' (\<lambda>a. \<not> tcbQueued a) p sb_) \<and> capAligned (capability.Zombie (global.capUntypedPtr (cteCap rv_)) bits_ num_) \<and> (\<not> expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb_))) proof (prove)
goal (5 subgoals):
 1. \<And>rv s rv' rva final sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; ((=) \<circ> from_bool) rva final; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb \<and> sch_act_simple sb \<and> cte_wp_at' ((=) rv) slot' sb \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)); s'a \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_cap' (cteCap rv) and (\<lambda>s. ksIdleThread s \<notin> capRange (cteCap rv)) and (\<lambda>s. 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize s) and (\<lambda>s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot') s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' s) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s)) sb \<and> s'a \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (final_'_update (\<lambda>_. final) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap rv) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool rva\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ccap_relation (fst rv) (remainder_C (ret__struct_finaliseCap_ret_C_' t)) \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C (ret__struct_finaliseCap_ret_C_' t)) \<longrightarrow> fc_ret_'_update (\<lambda>_. ret__struct_finaliseCap_ret_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
 2. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 3. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 4. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 5. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rv' rva sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb; sch_act_simple sb; cte_wp_at' ((=) rv) slot' sb; expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb; final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb)\<rbrakk> \<Longrightarrow> valid_cap' (cteCap rv) sb \<and> ksIdleThread sb \<notin> capRange (cteCap rv) \<and> 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize sb \<and> valid_cap' (cteCap rv) sb \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' sb \<and> valid_cap' (cteCap rv) sb \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' sb \<and> valid_cap' (cteCap rv) sb \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' sb \<and> weak_sch_act_wf (ksSchedulerAction sb) sb \<and> ccap_relation (cteCap rv) (h_val (hrs_mem (t_hrs_' (globals s'a))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))
 2. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 3. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 4. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 5. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rv' rva sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb; sch_act_simple sb; cte_wp_at' ((=) rv) slot' sb; expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb; final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb); \<exists>cte. rv = cte \<and> ksIdleThread sb \<notin> capRange (cteCap cte)\<rbrakk> \<Longrightarrow> valid_cap' (cteCap rv) sb \<and> ksIdleThread sb \<notin> capRange (cteCap rv) \<and> 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize sb \<and> valid_cap' (cteCap rv) sb \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' sb \<and> valid_cap' (cteCap rv) sb \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' sb \<and> valid_cap' (cteCap rv) sb \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) slot' sb \<and> weak_sch_act_wf (ksSchedulerAction sb) sb \<and> ccap_relation (cteCap rv) (h_val (hrs_mem (t_hrs_' (globals s'a))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))
 2. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 3. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 4. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 5. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rv' rva sa sb s'a. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; (rva, sa) \<in> fst (isFinalCapability rv s); (sb, s'a) \<in> rf_sr; invs' sb; sch_act_simple sb; ctes_of sb slot' = Some rv; expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb; final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb); ksIdleThread sb \<notin> capRange (cteCap rv)\<rbrakk> \<Longrightarrow> valid_cap' (cteCap rv) sb \<and> 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize sb \<and> valid_cap' (cteCap rv) sb \<and> weak_sch_act_wf (ksSchedulerAction sb) sb \<and> ccap_relation (cteCap rv) (h_val (hrs_mem (t_hrs_' (globals s'a))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))
 2. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 3. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 4. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 5. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rv' rva sa sb s'a y'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; (rva, sa) \<in> fst (isFinalCapability rv s); invs' sb; sch_act_simple sb; ctes_of sb slot' = Some rv; expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb; final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb); ksIdleThread sb \<notin> capRange (cteCap rv); ctes_of sb slot' = Some rv; ccte_relation rv y'; cslift s'a (cte_Ptr slot') = Some y'\<rbrakk> \<Longrightarrow> valid_cap' (cteCap rv) sb \<and> 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize sb \<and> valid_cap' (cteCap rv) sb \<and> weak_sch_act_wf (ksSchedulerAction sb) sb \<and> ccap_relation (cteCap rv) (h_val (hrs_mem (t_hrs_' (globals s'a))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))
 2. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 3. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 4. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 5. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rv' rva sa sb s'a y'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap; (rva, sa) \<in> fst (isFinalCapability rv s); invs' sb; sch_act_simple sb; ctes_of sb slot' = Some rv; expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' sb; final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of sb); ksIdleThread sb \<notin> capRange (cteCap rv); ctes_of sb slot' = Some rv; ccte_relation rv y'; cslift s'a (cte_Ptr slot') = Some y'; kernel_data_refs \<inter> capRange (cteCap rv) = {} \<and> global_refs' sb \<subseteq> kernel_data_refs \<and> 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize sb\<rbrakk> \<Longrightarrow> valid_cap' (cteCap rv) sb \<and> 2 ^ capBits (cteCap rv) \<le> gsMaxObjectSize sb \<and> valid_cap' (cteCap rv) sb \<and> weak_sch_act_wf (ksSchedulerAction sb) sb \<and> ccap_relation (cteCap rv) (h_val (hrs_mem (t_hrs_' (globals s'a))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))
 2. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 3. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 4. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 5. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv s rv'. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R951 rv\<rbrace> isFinalCapability rv \<lbrace>\<lambda>rva. (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) slot' (cteCaps_of s))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 2. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 3. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 4. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and ?R951 rv) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>rv s. (rv, s) \<in> fst (getCTE slot' s') \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s. s \<in> {s. (isNullCap (cteCap rv) \<longrightarrow> s \<in> UNIV) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> s \<in> {s. cte_'_update (\<lambda>_. cte_Ptr slot') s \<in> UNIV \<inter> \<lbrace>\<acute>cte = cte_Ptr slot'\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> final_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>})} \<inter> \<lbrace>(\<^bsup>s\<^esup>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace>}
 2. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> valid_mdb' s \<and> cte_wp_at' ((=) rv) slot' s \<and> final_matters' (cteCap rv) \<and> isFinal (cteCap rv) slot' (cteCaps_of s) = isFinal (cteCap rv) slot' (cteCaps_of s)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot')) s)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'11 rv \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 3. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> valid_mdb' s \<and> cte_wp_at' ((=) rv) slot' s \<and> final_matters' (cteCap rv) \<and> isFinal (cteCap rv) slot' (cteCaps_of s) = isFinal (cteCap rv) slot' (cteCaps_of s)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot')) s)) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> ?C'11 rv \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> valid_mdb' s \<and> cte_wp_at' ((=) rv) slot' s \<and> final_matters' (cteCap rv) \<and> isFinal (cteCap rv) slot' (cteCaps_of s) = isFinal (cteCap rv) slot' (cteCaps_of s)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot')) s)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace> \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) {s'. (sa, s') \<in> rf_sr}
 2. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> valid_mdb' s \<and> cte_wp_at' ((=) rv) slot' s \<and> final_matters' (cteCap rv) \<and> isFinal (cteCap rv) slot' (cteCaps_of s) = isFinal (cteCap rv) slot' (cteCaps_of s)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot')) s)) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>rv s sa. \<lbrakk>(rv, s) \<in> fst (getCTE slot' s'); (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> valid_mdb' s \<and> cte_wp_at' ((=) rv) slot' s \<and> final_matters' (cteCap rv) \<and> isFinal (cteCap rv) slot' (cteCaps_of s) = isFinal (cteCap rv) slot' (cteCaps_of s)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot')) s)) sa)\<rbrakk> \<Longrightarrow> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace> \<inter> {s'. (sa, s') \<in> rf_sr} \<subseteq> {s. \<forall>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) \<longrightarrow> (sa, s\<lparr>ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))\<rparr>) \<in> rf_sr}
 2. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> valid_mdb' s \<and> cte_wp_at' ((=) rv) slot' s \<and> final_matters' (cteCap rv) \<and> isFinal (cteCap rv) slot' (cteCaps_of s) = isFinal (cteCap rv) slot' (cteCaps_of s)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot')) s)) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>c. c = rv) slot' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>s. (isNullCap (cteCap rv) \<longrightarrow> True) \<and> (\<not> isNullCap (cteCap rv) \<longrightarrow> (cte_wp_at' ((=) rv) slot' and invs' and (\<lambda>s. invs' s \<and> sch_act_simple s \<and> cte_wp_at' ((=) rv) slot' s \<and> (expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s) \<and> (final_matters' (cteCap rv) \<longrightarrow> valid_mdb' s \<and> cte_wp_at' ((=) rv) slot' s \<and> final_matters' (cteCap rv) \<and> isFinal (cteCap rv) slot' (cteCaps_of s) = isFinal (cteCap rv) slot' (cteCaps_of s)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot')) s)) s)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s \<and> s' \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; ctes_of s slot' = Some rv; invs' s; sch_act_simple s; expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s\<rbrakk> \<Longrightarrow> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> final_matters' (cteCap rv) \<longrightarrow> valid_mdb' s) \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap)) proof (prove)
goal (1 subgoal):
 1. \<And>rv s s'. \<lbrakk>(s, s') \<in> rf_sr; ctes_of s slot' = Some rv; invs' s; sch_act_simple s; expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap) proof (prove)
goal (1 subgoal):
 1. \<And>rv s s' t. \<lbrakk>(s, s') \<in> rf_sr; ctes_of s slot' = Some rv; invs' s; sch_act_simple s; expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s; ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap) proof (prove)
goal (1 subgoal):
 1. \<And>rv s s' t y'. \<lbrakk>ctes_of s slot' = Some rv; invs' s; sch_act_simple s; expo \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot' s; ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))); ctes_of s slot' = Some rv; ccte_relation rv y'; cslift s' (cte_Ptr slot') = Some y'\<rbrakk> \<Longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot'\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap rv = capability.NullCap) proof (prove)
goal:
No subgoals! proof (prove)
goal:
No subgoals!