theory CNodeInv_R

lemma cteRevoke_corres':
  "spec_corres s (dc \<oplus> dc)
      (einvs and simple_sched_action and cte_at ptr)
      (invs' and sch_act_simple and cte_at' (cte_map ptr))
      (cap_revoke ptr) (\<lambda>s. cteRevoke (cte_map ptr) s)" proof (induct rule: cap_revoke.induct) case (1 slot s') show ?case apply (subst cap_revoke.simps) apply (subst cteRevoke.simps[abs_def]) apply (simp add: liftE_bindE next_revoke_cap_def select_ext_def bind_assoc) apply (rule spec_corres_symb_exec_l_Ex2) apply (clarsimp simp: cte_wp_at_def) apply (rule spec_corres_symb_exec_l_Ex2) apply (simp add: in_monad) apply (rule spec_corres_symb_exec_r_Ex) apply (clarsimp elim!: use_valid [OF _ getCTE_inv]) apply (clarsimp simp: cte_at'_def getCTE_def) apply (rule no_fail_pre, wp) apply clarsimp apply (simp add: in_monad in_get_cap_cte_wp_at
                              in_getCTE_cte_wp_at') apply (rule_tac F="cap_relation cap (cteCap cte)"
              in spec_corres_req) apply (clarsimp | erule(2) state_relation_cap_relation)+ apply (case_tac "cap = cap.NullCap") apply (simp add: whenE_def) apply (case_tac "cteCap cte = NullCap") apply (simp add: whenE_def) apply (case_tac "descendants_of slot (cdt s') = {}") apply (case_tac "mdbNext (cteMDBNode cte) = nullPointer") apply (simp add: whenE_def) apply (simp add: whenE_def[where P=True]) apply (rule spec_corres_symb_exec_r_Ex) apply (clarsimp elim!: use_valid [OF _ getCTE_inv]) apply clarsimp apply (subgoal_tac "cte_at' (mdbNext (cteMDBNode cte)) s") apply (clarsimp simp: getCTE_def cte_at'_def) apply (drule invs_mdb') apply (clarsimp simp: cte_wp_at_ctes_of valid_mdb'_def valid_mdb_ctes_def nullPointer_def) apply (erule (2) valid_dlistEn) apply simp apply (rule no_fail_pre, wp) apply clarsimp apply (drule invs_mdb') apply (clarsimp simp: cte_wp_at_ctes_of valid_mdb'_def valid_mdb_ctes_def nullPointer_def) apply (erule (2) valid_dlistEn) apply simp apply (rule_tac F="\<not> isMDBParentOf cte nextCTE"
               in spec_corres_req) apply (clarsimp simp: in_getCTE_cte_wp_at') apply (subst(asm) cap_revoke_mdb_stuff1, assumption+) apply (clarsimp simp: cte_wp_at'_def) apply (simp add: whenE_def) apply (rule_tac F="mdbNext (cteMDBNode cte) \<noteq> nullPointer"
              in spec_corres_req) apply clarsimp apply (subst(asm) cap_revoke_mdb_stuff1, assumption+) apply (clarsimp simp: cte_wp_at'_def) apply (simp add: whenE_def[where P=True]) apply (rule spec_corres_symb_exec_r_Ex) apply (clarsimp elim!: use_valid [OF _ getCTE_inv]) apply (subgoal_tac "cte_at' (mdbNext (cteMDBNode cte)) s") apply (clarsimp simp: getCTE_def cte_at'_def) apply clarsimp apply (drule invs_mdb') apply (clarsimp simp: cte_wp_at_ctes_of valid_mdb'_def valid_mdb_ctes_def nullPointer_def) apply (erule (2) valid_dlistEn) apply simp apply (rule no_fail_pre, wp) apply clarsimp apply (drule invs_mdb') apply (clarsimp simp: cte_wp_at_ctes_of valid_mdb'_def valid_mdb_ctes_def nullPointer_def) apply (erule (2) valid_dlistEn) apply simp apply (simp add: in_monad in_get_cap_cte_wp_at
                              in_getCTE_cte_wp_at') apply(case_tac "next_child slot (cdt_list s')") apply(rule_tac F="False" in spec_corres_req) apply(clarsimp) apply(frule next_child_NoneD) apply(simp add: empty_list_empty_desc) apply(simp) apply (rule_tac F="valid_list s'" in spec_corres_req,simp) apply (frule next_child_child_set, assumption) apply simp apply (rule spec_corres_symb_exec_l_Ex2) apply (simp add: in_monad) apply (rule spec_corres_symb_exec_l_Ex2) apply (simp add: in_monad) apply (drule next_childD, simp) apply (simp add: child_descendant) apply (rule spec_corres_symb_exec_l_Ex2) apply (clarsimp simp: in_monad) apply (drule next_childD, simp) apply (clarsimp) apply (drule child_descendant) apply (drule descendants_of_cte_at, erule invs_mdb) apply (clarsimp simp: cte_wp_at_def) apply (simp add: in_monad) apply(case_tac "capa = cap.NullCap") apply(rule_tac F="False" in spec_corres_req) apply(clarsimp) apply(drule next_childD, simp) apply(clarsimp) apply(drule child_descendant) apply(drule cap_revoke_mdb_stuff3) apply(erule invs_mdb) apply(clarsimp simp: cte_wp_at_def) apply(simp) apply (simp) apply (rule_tac F="isMDBParentOf cte nextCTE"
             in spec_corres_req) apply clarsimp apply(frule cap_revoke_mdb_stuff1, (simp add: in_get_cap_cte_wp_at)+) apply (clarsimp simp: cte_wp_at'_def) apply (rule spec_corres_req) apply clarsimp apply (rule cap_revoke_mdb_stuff4, (simp add: in_get_cap_cte_wp_at)+) apply (clarsimp simp: whenE_def) apply (rule spec_corres_guard_imp) apply (rule spec_corres_splitE' [OF cteDelete_corres]) apply (rule spec_corres_splitE' [OF preemptionPoint_corres]) apply (rule "1.hyps",
                   (simp add: cte_wp_at_def in_monad select_def next_revoke_cap_def select_ext_def
                     | assumption | rule conjI refl)+)[1] apply (wp cap_delete_cte_at cteDelete_invs' cteDelete_sch_act_simple
                   preemptionPoint_invR preemption_point_inv' | clarsimp)+ apply (clarsimp simp: cte_wp_at_cte_at) apply(drule next_childD, simp) apply(clarsimp, drule child_descendant) apply (fastforce simp: emptyable_def dest: reply_slot_not_descendant) apply (clarsimp elim!: cte_wp_at_weakenE') done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. spec_corres s (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) ptr) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map ptr)) (cap_revoke ptr) (cteRevoke (cte_map ptr)) proof (state)
goal (1 subgoal):
 1. \<And>slot s. (\<And>rv st rva sta rvb stb rvc stc rvd std rve ste rvf stf rvg stg. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); (Inr rva, sta) \<in> fst ((without_preemption $ gets cdt) st); (Inr rvb, stb) \<in> fst ((returnOk $ descendants_of slot rva) sta); rv \<noteq> cap.NullCap \<and> rvb \<noteq> {}; (Inr rvc, stc) \<in> fst ((without_preemption $ select_ext (next_revoke_cap slot) rvb) stb); (Inr rvd, std) \<in> fst ((without_preemption $ get_cap rvc) stc); (Inr rve, ste) \<in> fst (assertE (rvd \<noteq> cap.NullCap) std); (Inr rvf, stf) \<in> fst (cap_delete rvc ste); (Inr rvg, stg) \<in> fst (preemption_point stf)\<rbrakk> \<Longrightarrow> spec_corres stg (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (cap_revoke slot) (cteRevoke (cte_map slot))) \<Longrightarrow> spec_corres s (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (cap_revoke slot) (cteRevoke (cte_map slot)) proof (state)
this:
\<lbrakk>(Inr ?rv, ?st) \<in> fst ((without_preemption $ get_cap slot) s'); (Inr ?rva, ?sta) \<in> fst ((without_preemption $ gets cdt) ?st); (Inr ?rvb, ?stb) \<in> fst ((returnOk $ descendants_of slot ?rva) ?sta); ?rv \<noteq> cap.NullCap \<and> ?rvb \<noteq> {}; (Inr ?rvc, ?stc) \<in> fst ((without_preemption $ select_ext (next_revoke_cap slot) ?rvb) ?stb); (Inr ?rvd, ?std) \<in> fst ((without_preemption $ get_cap ?rvc) ?stc); (Inr ?rve, ?ste) \<in> fst (assertE (?rvd \<noteq> cap.NullCap) ?std); (Inr ?rvf, ?stf) \<in> fst (cap_delete ?rvc ?ste); (Inr ?rvg, ?stg) \<in> fst (preemption_point ?stf)\<rbrakk> \<Longrightarrow> spec_corres ?stg (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (cap_revoke slot) (cteRevoke (cte_map slot))

goal (1 subgoal):
 1. \<And>slot s. (\<And>rv st rva sta rvb stb rvc stc rvd std rve ste rvf stf rvg stg. \<lbrakk>(Inr rv, st) \<in> fst ((without_preemption $ get_cap slot) s); (Inr rva, sta) \<in> fst ((without_preemption $ gets cdt) st); (Inr rvb, stb) \<in> fst ((returnOk $ descendants_of slot rva) sta); rv \<noteq> cap.NullCap \<and> rvb \<noteq> {}; (Inr rvc, stc) \<in> fst ((without_preemption $ select_ext (next_revoke_cap slot) rvb) stb); (Inr rvd, std) \<in> fst ((without_preemption $ get_cap rvc) stc); (Inr rve, ste) \<in> fst (assertE (rvd \<noteq> cap.NullCap) std); (Inr rvf, stf) \<in> fst (cap_delete rvc ste); (Inr rvg, stg) \<in> fst (preemption_point stf)\<rbrakk> \<Longrightarrow> spec_corres stg (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (cap_revoke slot) (cteRevoke (cte_map slot))) \<Longrightarrow> spec_corres s (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (cap_revoke slot) (cteRevoke (cte_map slot)) proof (prove)
goal (1 subgoal):
 1. spec_corres s' (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (cap_revoke slot) (cteRevoke (cte_map slot)) proof (prove)
goal (1 subgoal):
 1. spec_corres s' (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (doE cap <- without_preemption $ get_cap slot;
cdt <- without_preemption $ gets cdt;
descendants <- returnOk $ descendants_of slot cdt;
whenE (cap \<noteq> cap.NullCap \<and> descendants \<noteq> {}) (doE child <- without_preemption $ select_ext (next_revoke_cap slot) descendants;
cap <- without_preemption $ get_cap child;
assertE (cap \<noteq> cap.NullCap);
cap_delete child;
preemption_point;
cap_revoke slot
odE)
odE) (cteRevoke (cte_map slot)) proof (prove)
goal (1 subgoal):
 1. spec_corres s' (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (doE cap <- without_preemption $ get_cap slot;
cdt <- without_preemption $ gets cdt;
descendants <- returnOk $ descendants_of slot cdt;
whenE (cap \<noteq> cap.NullCap \<and> descendants \<noteq> {}) (doE child <- without_preemption $ select_ext (next_revoke_cap slot) descendants;
cap <- without_preemption $ get_cap child;
assertE (cap \<noteq> cap.NullCap);
cap_delete child;
preemption_point;
cap_revoke slot
odE)
odE) (doE cte <- withoutPreemption $ getCTE (cte_map slot);
nextPtr <- returnOk (mdbNext $ cteMDBNode cte);
unlessE ((isNullCap $ cteCap cte) \<or> nextPtr = nullPointer) $ doE nextCTE <- withoutPreemption $ getCTE nextPtr;
whenE (cte `~isMDBParentOf~` nextCTE) $ doE cteDelete nextPtr True;
preemptionPoint;
cteRevoke (cte_map slot)
odE
odE
odE) proof (prove)
goal (1 subgoal):
 1. spec_corres s' (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (do cap <- get_cap slot;
cdt <- gets cdt;
whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot cdt \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot cdt);
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)
od) (do cte <- getCTE (cte_map slot);
unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)
od) proof (prove)
goal (2 subgoals):
 1. (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) s' \<Longrightarrow> \<exists>cap. (cap, s') \<in> fst (get_cap slot s')
 2. \<And>cap. (cap, s') \<in> fst (get_cap slot s') \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'. (cap, s) \<in> fst (get_cap slot s') \<and> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) s') (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (do cdt <- gets cdt;
whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot cdt \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot cdt);
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)
od) (do cte <- getCTE (cte_map slot);
unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)
od) proof (prove)
goal (1 subgoal):
 1. \<And>cap. (cap, s') \<in> fst (get_cap slot s') \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'. (cap, s) \<in> fst (get_cap slot s') \<and> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) s') (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (do cdt <- gets cdt;
whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot cdt \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot cdt);
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)
od) (do cte <- getCTE (cte_map slot);
unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)
od) proof (prove)
goal (2 subgoals):
 1. \<And>cap. \<lbrakk>(cap, s') \<in> fst (get_cap slot s'); \<exists>s'a. (cap, s') \<in> fst (get_cap slot s'a) \<and> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) s'a\<rbrakk> \<Longrightarrow> \<exists>cdta. (cdta, s') \<in> fst (gets cdt s')
 2. \<And>cap cdta. \<lbrakk>(cap, s') \<in> fst (get_cap slot s'); (cdta, s') \<in> fst (gets cdt s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'. (cdta, s) \<in> fst (gets cdt s') \<and> (\<exists>s'a. (cap, s') \<in> fst (get_cap slot s'a) \<and> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) s'a)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot cdta \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot cdta);
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (do cte <- getCTE (cte_map slot);
unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)
od) proof (prove)
goal (1 subgoal):
 1. \<And>cap cdta. \<lbrakk>(cap, s') \<in> fst (get_cap slot s'); (cdta, s') \<in> fst (gets cdt s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'. (cdta, s) \<in> fst (gets cdt s') \<and> (\<exists>s'a. (cap, s') \<in> fst (get_cap slot s'a) \<and> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) s'a)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot cdta \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot cdta);
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (do cte <- getCTE (cte_map slot);
unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)
od) proof (prove)
goal (4 subgoals):
 1. \<And>cap cdta s. \<lbrakk>(cap, s') \<in> fst (get_cap slot s'); (cdta, s') \<in> fst (gets cdt s'); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> \<forall>p\<in>fst (getCTE (cte_map slot) s). snd p = s
 2. \<And>cap cdta s. \<lbrakk>(cap, s') \<in> fst (get_cap slot s'); (cdta, s') \<in> fst (gets cdt s'); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> \<exists>p\<in>fst (getCTE (cte_map slot) s). snd p = s
 3. \<And>cap cdta. \<lbrakk>(cap, s') \<in> fst (get_cap slot s'); (cdta, s') \<in> fst (gets cdt s')\<rbrakk> \<Longrightarrow> no_fail (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (getCTE (cte_map slot))
 4. \<And>cap cdta cte. \<lbrakk>(cap, s') \<in> fst (get_cap slot s'); (cdta, s') \<in> fst (gets cdt s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'. (cdta, s) \<in> fst (gets cdt s') \<and> (\<exists>s'a. (cap, s') \<in> fst (get_cap slot s'a) \<and> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) s'a)) (\<lambda>s. \<exists>s'. (cte, s) \<in> fst (getCTE (cte_map slot) s') \<and> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s') (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot cdta \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot cdta);
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cdta s. \<lbrakk>(cap, s') \<in> fst (get_cap slot s'); (cdta, s') \<in> fst (gets cdt s'); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> \<exists>p\<in>fst (getCTE (cte_map slot) s). snd p = s
 2. \<And>cap cdta. \<lbrakk>(cap, s') \<in> fst (get_cap slot s'); (cdta, s') \<in> fst (gets cdt s')\<rbrakk> \<Longrightarrow> no_fail (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (getCTE (cte_map slot))
 3. \<And>cap cdta cte. \<lbrakk>(cap, s') \<in> fst (get_cap slot s'); (cdta, s') \<in> fst (gets cdt s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'. (cdta, s) \<in> fst (gets cdt s') \<and> (\<exists>s'a. (cap, s') \<in> fst (get_cap slot s'a) \<and> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) s'a)) (\<lambda>s. \<exists>s'. (cte, s) \<in> fst (getCTE (cte_map slot) s') \<and> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s') (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot cdta \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot cdta);
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cdta. \<lbrakk>(cap, s') \<in> fst (get_cap slot s'); (cdta, s') \<in> fst (gets cdt s')\<rbrakk> \<Longrightarrow> no_fail (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (getCTE (cte_map slot))
 2. \<And>cap cdta cte. \<lbrakk>(cap, s') \<in> fst (get_cap slot s'); (cdta, s') \<in> fst (gets cdt s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'. (cdta, s) \<in> fst (gets cdt s') \<and> (\<exists>s'a. (cap, s') \<in> fst (get_cap slot s'a) \<and> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) s'a)) (\<lambda>s. \<exists>s'. (cte, s) \<in> fst (getCTE (cte_map slot) s') \<and> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s') (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot cdta \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot cdta);
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cdta s. \<lbrakk>(cap, s') \<in> fst (get_cap slot s'); (cdta, s') \<in> fst (gets cdt s'); (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s
 2. \<And>cap cdta cte. \<lbrakk>(cap, s') \<in> fst (get_cap slot s'); (cdta, s') \<in> fst (gets cdt s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'. (cdta, s) \<in> fst (gets cdt s') \<and> (\<exists>s'a. (cap, s') \<in> fst (get_cap slot s'a) \<and> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) s'a)) (\<lambda>s. \<exists>s'. (cte, s) \<in> fst (getCTE (cte_map slot) s') \<and> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s') (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot cdta \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot cdta);
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cdta cte. \<lbrakk>(cap, s') \<in> fst (get_cap slot s'); (cdta, s') \<in> fst (gets cdt s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'. (cdta, s) \<in> fst (gets cdt s') \<and> (\<exists>s'a. (cap, s') \<in> fst (get_cap slot s'a) \<and> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) s'a)) (\<lambda>s. \<exists>s'. (cte, s) \<in> fst (getCTE (cte_map slot) s') \<and> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s') (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot cdta \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot cdta);
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cdta cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cdta = cdt s'\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cdta cte s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cdta = cdt s'; cdt s' = cdt s' \<and> cte_wp_at ((=) cap) slot s' \<and> invs s' \<and> valid_list s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s'; cte_wp_at' ((=) cte) (cte_map slot) s'a \<and> invs' s'a \<and> sch_act_simple s'a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; (s', s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> cap_relation cap (cteCap cte)
 2. \<And>cap cdta cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cdta = cdt s'; cap_relation cap (cteCap cte)\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte)\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap = cap.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od))
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte = capability.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od))
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od))
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) = nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od))
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od))
 3. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od))
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE False (do x <- get;
fail
od)) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (5 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s\<rbrakk> \<Longrightarrow> \<forall>p\<in>fst (getCTE (mdbNext (cteMDBNode cte)) s). snd p = s
 2. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s\<rbrakk> \<Longrightarrow> \<exists>p\<in>fst (getCTE (mdbNext (cteMDBNode cte)) s). snd p = s
 3. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (getCTE (mdbNext (cteMDBNode cte)))
 4. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (whenE False (do x <- get;
fail
od)) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 5. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (4 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s\<rbrakk> \<Longrightarrow> \<exists>p\<in>fst (getCTE (mdbNext (cteMDBNode cte)) s). snd p = s
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (getCTE (mdbNext (cteMDBNode cte)))
 3. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (whenE False (do x <- get;
fail
od)) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 4. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (4 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s; invs' s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s\<rbrakk> \<Longrightarrow> \<exists>p\<in>fst (getCTE (mdbNext (cteMDBNode cte)) s). snd p = s
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (getCTE (mdbNext (cteMDBNode cte)))
 3. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (whenE False (do x <- get;
fail
od)) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 4. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (5 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s; invs' s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s; cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s\<rbrakk> \<Longrightarrow> \<exists>p\<in>fst (getCTE (mdbNext (cteMDBNode cte)) s). snd p = s
 2. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s; invs' s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s
 3. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (getCTE (mdbNext (cteMDBNode cte)))
 4. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (whenE False (do x <- get;
fail
od)) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 5. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (4 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s; invs' s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (getCTE (mdbNext (cteMDBNode cte)))
 3. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (whenE False (do x <- get;
fail
od)) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 4. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (4 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s; valid_mdb' s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (getCTE (mdbNext (cteMDBNode cte)))
 3. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (whenE False (do x <- get;
fail
od)) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 4. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (4 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> 0; ctes_of s (cte_map slot) = Some cte; sch_act_simple s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> \<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (getCTE (mdbNext (cteMDBNode cte)))
 3. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (whenE False (do x <- get;
fail
od)) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 4. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (4 subgoals):
 1. \<And>cap cte s cte'. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> 0; ctes_of s (cte_map slot) = Some cte; sch_act_simple s; no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ctes_of s (mdbNext (cteMDBNode cte)) = Some cte'; mdbPrev (cteMDBNode cte') = cte_map slot\<rbrakk> \<Longrightarrow> \<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (getCTE (mdbNext (cteMDBNode cte)))
 3. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (whenE False (do x <- get;
fail
od)) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 4. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (getCTE (mdbNext (cteMDBNode cte)))
 2. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (whenE False (do x <- get;
fail
od)) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 3. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s
 2. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (whenE False (do x <- get;
fail
od)) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 3. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s; invs' s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s
 2. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (whenE False (do x <- get;
fail
od)) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 3. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s; valid_mdb' s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s
 2. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (whenE False (do x <- get;
fail
od)) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 3. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> 0; ctes_of s (cte_map slot) = Some cte; sch_act_simple s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> \<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea
 2. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (whenE False (do x <- get;
fail
od)) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 3. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte s cte'. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> 0; ctes_of s (cte_map slot) = Some cte; sch_act_simple s; no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ctes_of s (mdbNext (cteMDBNode cte)) = Some cte'; mdbPrev (cteMDBNode cte') = cte_map slot\<rbrakk> \<Longrightarrow> \<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea
 2. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (whenE False (do x <- get;
fail
od)) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 3. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (whenE False (do x <- get;
fail
od)) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte nextCTE s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cdt s' = cdt s' \<and> cte_wp_at ((=) cap) slot s' \<and> invs s' \<and> valid_list s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s'; \<exists>s'. (nextCTE, s'a) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'; (s', s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> \<not> isMDBParentOf cte nextCTE
 2. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; \<not> isMDBParentOf cte nextCTE\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (whenE False (do x <- get;
fail
od)) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 3. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte nextCTE s'a. \<lbrakk>cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; (s', s'a) \<in> state_relation; cte_wp_at ((=) cap) slot s'; cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s'a; invs s'; cte_wp_at' ((=) cte) (cte_map slot) s'a; valid_list s'; invs' s'a; valid_sched s'; sch_act_simple s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'; isMDBParentOf cte nextCTE\<rbrakk> \<Longrightarrow> False
 2. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; \<not> isMDBParentOf cte nextCTE\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (whenE False (do x <- get;
fail
od)) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 3. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte nextCTE s'a. \<lbrakk>cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; \<not> (mdbNext (cteMDBNode cte) \<noteq> nullPointer \<and> cte_wp_at' (isMDBParentOf cte) (mdbNext (cteMDBNode cte)) s'a); mdbNext (cteMDBNode cte) \<noteq> nullPointer; (s', s'a) \<in> state_relation; cte_wp_at ((=) cap) slot s'; cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s'a; invs s'; cte_wp_at' ((=) cte) (cte_map slot) s'a; valid_list s'; invs' s'a; valid_sched s'; sch_act_simple s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'; isMDBParentOf cte nextCTE\<rbrakk> \<Longrightarrow> False
 2. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; \<not> isMDBParentOf cte nextCTE\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (whenE False (do x <- get;
fail
od)) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 3. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') = {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; \<not> isMDBParentOf cte nextCTE\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (whenE False (do x <- get;
fail
od)) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cdt s' = cdt s' \<and> cte_wp_at ((=) cap) slot s' \<and> invs s' \<and> valid_list s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s'; cte_wp_at' ((=) cte) (cte_map slot) s'a \<and> invs' s'a \<and> sch_act_simple s'a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; (s', s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> nullPointer
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte s'a. \<lbrakk>cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; (s', s'a) \<in> state_relation; cte_wp_at ((=) cap) slot s'; cte_wp_at' ((=) cte) (cte_map slot) s'a; invs s'; invs' s'a; valid_list s'; sch_act_simple s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; valid_sched s'; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'; mdbNext (cteMDBNode cte) = nullPointer\<rbrakk> \<Longrightarrow> False
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte s'a. \<lbrakk>cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; \<not> \<not> (mdbNext (cteMDBNode cte) \<noteq> nullPointer \<and> cte_wp_at' (isMDBParentOf cte) (mdbNext (cteMDBNode cte)) s'a); (s', s'a) \<in> state_relation; cte_wp_at ((=) cap) slot s'; cte_wp_at' ((=) cte) (cte_map slot) s'a; invs s'; invs' s'a; valid_list s'; sch_act_simple s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; valid_sched s'; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'; mdbNext (cteMDBNode cte) = nullPointer\<rbrakk> \<Longrightarrow> False
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (whenE (cap \<noteq> cap.NullCap \<and> descendants_of slot (cdt s') \<noteq> {}) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od)) (unlessE (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (do nextCTE <- getCTE (mdbNext (cteMDBNode cte));
whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
od) proof (prove)
goal (4 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s\<rbrakk> \<Longrightarrow> \<forall>p\<in>fst (getCTE (mdbNext (cteMDBNode cte)) s). snd p = s
 2. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s\<rbrakk> \<Longrightarrow> \<exists>p\<in>fst (getCTE (mdbNext (cteMDBNode cte)) s). snd p = s
 3. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (getCTE (mdbNext (cteMDBNode cte)))
 4. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s\<rbrakk> \<Longrightarrow> \<exists>p\<in>fst (getCTE (mdbNext (cteMDBNode cte)) s). snd p = s
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (getCTE (mdbNext (cteMDBNode cte)))
 3. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (4 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s; cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s\<rbrakk> \<Longrightarrow> \<exists>p\<in>fst (getCTE (mdbNext (cteMDBNode cte)) s). snd p = s
 2. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s
 3. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (getCTE (mdbNext (cteMDBNode cte)))
 4. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (getCTE (mdbNext (cteMDBNode cte)))
 3. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s; invs' s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (getCTE (mdbNext (cteMDBNode cte)))
 3. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s; valid_mdb' s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (getCTE (mdbNext (cteMDBNode cte)))
 3. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> 0; ctes_of s (cte_map slot) = Some cte; sch_act_simple s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> \<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (getCTE (mdbNext (cteMDBNode cte)))
 3. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte s cte'. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> 0; ctes_of s (cte_map slot) = Some cte; sch_act_simple s; no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ctes_of s (mdbNext (cteMDBNode cte)) = Some cte'; mdbPrev (cteMDBNode cte') = cte_map slot\<rbrakk> \<Longrightarrow> \<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea
 2. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (getCTE (mdbNext (cteMDBNode cte)))
 3. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (getCTE (mdbNext (cteMDBNode cte)))
 2. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s
 2. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s; invs' s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s
 2. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; cte_wp_at' ((=) cte) (cte_map slot) s; sch_act_simple s; cte_wp_at' (\<lambda>_. True) (cte_map slot) s; valid_mdb' s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s
 2. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte s. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> 0; ctes_of s (cte_map slot) = Some cte; sch_act_simple s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> \<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea
 2. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte s cte'. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> 0; ctes_of s (cte_map slot) = Some cte; sch_act_simple s; no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ctes_of s (mdbNext (cteMDBNode cte)) = Some cte'; mdbPrev (cteMDBNode cte') = cte_map slot\<rbrakk> \<Longrightarrow> \<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea
 2. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. \<exists>s'. (nextCTE, s) \<in> fst (getCTE (mdbNext (cteMDBNode cte)) s') \<and> cte_wp_at' ((=) cte) (cte_map slot) s' \<and> invs' s' \<and> sch_act_simple s' \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s') (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = None\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 2. \<And>cap cte nextCTE a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte nextCTE s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = None; cdt s' = cdt s' \<and> cte_wp_at ((=) cap) slot s' \<and> invs s' \<and> valid_list s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s'; cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s'a \<and> cte_wp_at' ((=) cte) (cte_map slot) s'a \<and> invs' s'a \<and> sch_act_simple s'a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; (s', s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> False
 2. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = None; False\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 3. \<And>cap cte nextCTE a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte nextCTE s'a. \<lbrakk>cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = None; (s', s'a) \<in> state_relation; cte_wp_at ((=) cap) slot s'; cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s'a; invs s'; cte_wp_at' ((=) cte) (cte_map slot) s'a; valid_list s'; invs' s'a; valid_sched s'; sch_act_simple s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'\<rbrakk> \<Longrightarrow> False
 2. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = None; False\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 3. \<And>cap cte nextCTE a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte nextCTE s'a. \<lbrakk>cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = None; (s', s'a) \<in> state_relation; cte_wp_at ((=) cap) slot s'; cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s'a; invs s'; cte_wp_at' ((=) cte) (cte_map slot) s'a; valid_list s'; invs' s'a; valid_sched s'; sch_act_simple s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'; cdt_list s' slot = []\<rbrakk> \<Longrightarrow> False
 2. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = None; False\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 3. \<And>cap cte nextCTE a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte nextCTE. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = None; False\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 2. \<And>cap cte nextCTE a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte nextCTE a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte nextCTE a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte nextCTE a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; a \<in> (case next_child slot (cdt_list s') of None \<Rightarrow> {} | Some n \<Rightarrow> {n})\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte nextCTE a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. cdt s' = cdt s \<and> cte_wp_at ((=) cap) slot s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do x <- get;
y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte nextCTE a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; cdt s' = cdt s' \<and> cte_wp_at ((=) cap) slot s' \<and> invs s' \<and> valid_list s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s'\<rbrakk> \<Longrightarrow> \<exists>x. (x, s') \<in> fst (get s')
 2. \<And>cap cte nextCTE a x. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; (x, s') \<in> fst (get s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'a. (x, s) \<in> fst (get s'a) \<and> cdt s' = cdt s'a \<and> cte_wp_at ((=) cap) slot s'a \<and> invs s'a \<and> valid_list s'a \<and> valid_sched s'a \<and> simple_sched_action s'a \<and> cte_wp_at (\<lambda>_. True) slot s'a) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte nextCTE a x. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; (x, s') \<in> fst (get s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'a. (x, s) \<in> fst (get s'a) \<and> cdt s' = cdt s'a \<and> cte_wp_at ((=) cap) slot s'a \<and> invs s'a \<and> valid_list s'a \<and> valid_sched s'a \<and> simple_sched_action s'a \<and> cte_wp_at (\<lambda>_. True) slot s'a) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do y <- assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s'));
cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte nextCTE a x. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; (x, s') \<in> fst (get s'); \<exists>s'a. (x, s') \<in> fst (get s'a) \<and> cdt s' = cdt s'a \<and> cte_wp_at ((=) cap) slot s'a \<and> invs s'a \<and> valid_list s'a \<and> valid_sched s'a \<and> simple_sched_action s'a \<and> cte_wp_at (\<lambda>_. True) slot s'a\<rbrakk> \<Longrightarrow> \<exists>y. (y, s') \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s')
 2. \<And>cap cte nextCTE a x y. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; (x, s') \<in> fst (get s'); (y, s') \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'a. (y, s) \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s'a) \<and> (\<exists>s'b. (x, s'a) \<in> fst (get s'b) \<and> cdt s' = cdt s'b \<and> cte_wp_at ((=) cap) slot s'b \<and> invs s'b \<and> valid_list s'b \<and> valid_sched s'b \<and> simple_sched_action s'b \<and> cte_wp_at (\<lambda>_. True) slot s'b)) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte a x. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s'\<rbrakk> \<Longrightarrow> a \<in> descendants_of slot (cdt s')
 2. \<And>cap cte nextCTE a x y. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; (x, s') \<in> fst (get s'); (y, s') \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'a. (y, s) \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s'a) \<and> (\<exists>s'b. (x, s'a) \<in> fst (get s'b) \<and> cdt s' = cdt s'b \<and> cte_wp_at ((=) cap) slot s'b \<and> invs s'b \<and> valid_list s'b \<and> valid_sched s'b \<and> simple_sched_action s'b \<and> cte_wp_at (\<lambda>_. True) slot s'b)) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte a x. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; valid_list s'; x = s'; invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s'; (\<exists>xs. cdt_list s' slot = a # xs) \<and> cdt x a = Some slot\<rbrakk> \<Longrightarrow> a \<in> descendants_of slot (cdt s')
 2. \<And>cap cte nextCTE a x y. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; (x, s') \<in> fst (get s'); (y, s') \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'a. (y, s) \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s'a) \<and> (\<exists>s'b. (x, s'a) \<in> fst (get s'b) \<and> cdt s' = cdt s'b \<and> cte_wp_at ((=) cap) slot s'b \<and> invs s'b \<and> valid_list s'b \<and> valid_sched s'b \<and> simple_sched_action s'b \<and> cte_wp_at (\<lambda>_. True) slot s'b)) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte nextCTE a x y. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; (x, s') \<in> fst (get s'); (y, s') \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'a. (y, s) \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s'a) \<and> (\<exists>s'b. (x, s'a) \<in> fst (get s'b) \<and> cdt s' = cdt s'b \<and> cte_wp_at ((=) cap) slot s'b \<and> invs s'b \<and> valid_list s'b \<and> valid_sched s'b \<and> simple_sched_action s'b \<and> cte_wp_at (\<lambda>_. True) slot s'b)) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (do cap <- get_cap (the (next_child slot (cdt_list x)));
doE y <- assertE (cap \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE
od) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte nextCTE a x y. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; (x, s') \<in> fst (get s'); (y, s') \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s'); \<exists>s'a. (y, s') \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s'a) \<and> (\<exists>s'b. (x, s'a) \<in> fst (get s'b) \<and> cdt s' = cdt s'b \<and> cte_wp_at ((=) cap) slot s'b \<and> invs s'b \<and> valid_list s'b \<and> valid_sched s'b \<and> simple_sched_action s'b \<and> cte_wp_at (\<lambda>_. True) slot s'b)\<rbrakk> \<Longrightarrow> \<exists>cap. (cap, s') \<in> fst (get_cap (the (next_child slot (cdt_list x))) s')
 2. \<And>cap cte nextCTE a x y capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; (x, s') \<in> fst (get s'); (y, s') \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s'); (capa, s') \<in> fst (get_cap (the (next_child slot (cdt_list x))) s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'a. (capa, s) \<in> fst (get_cap (the (next_child slot (cdt_list x))) s'a) \<and> (\<exists>s'b. (y, s'a) \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s'b) \<and> (\<exists>s'a. (x, s'b) \<in> fst (get s'a) \<and> cdt s' = cdt s'a \<and> cte_wp_at ((=) cap) slot s'a \<and> invs s'a \<and> valid_list s'a \<and> valid_sched s'a \<and> simple_sched_action s'a \<and> cte_wp_at (\<lambda>_. True) slot s'a))) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte a b. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (a, b); valid_list s'; (a, b) \<in> descendants_of slot (cdt s'); invs s'; valid_sched s'; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'\<rbrakk> \<Longrightarrow> \<exists>cap. (cap, s') \<in> fst (get_cap (a, b) s')
 2. \<And>cap cte nextCTE a x y capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; (x, s') \<in> fst (get s'); (y, s') \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s'); (capa, s') \<in> fst (get_cap (the (next_child slot (cdt_list x))) s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'a. (capa, s) \<in> fst (get_cap (the (next_child slot (cdt_list x))) s'a) \<and> (\<exists>s'b. (y, s'a) \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s'b) \<and> (\<exists>s'a. (x, s'b) \<in> fst (get s'a) \<and> cdt s' = cdt s'a \<and> cte_wp_at ((=) cap) slot s'a \<and> invs s'a \<and> valid_list s'a \<and> valid_sched s'a \<and> simple_sched_action s'a \<and> cte_wp_at (\<lambda>_. True) slot s'a))) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte a b. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; valid_list s'; (a, b) \<in> descendants_of slot (cdt s'); invs s'; valid_sched s'; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'; (\<exists>xs. cdt_list s' slot = (a, b) # xs) \<and> cdt s' (a, b) = Some slot\<rbrakk> \<Longrightarrow> \<exists>cap. (cap, s') \<in> fst (get_cap (a, b) s')
 2. \<And>cap cte nextCTE a x y capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; (x, s') \<in> fst (get s'); (y, s') \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s'); (capa, s') \<in> fst (get_cap (the (next_child slot (cdt_list x))) s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'a. (capa, s) \<in> fst (get_cap (the (next_child slot (cdt_list x))) s'a) \<and> (\<exists>s'b. (y, s'a) \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s'b) \<and> (\<exists>s'a. (x, s'b) \<in> fst (get s'a) \<and> cdt s' = cdt s'a \<and> cte_wp_at ((=) cap) slot s'a \<and> invs s'a \<and> valid_list s'a \<and> valid_sched s'a \<and> simple_sched_action s'a \<and> cte_wp_at (\<lambda>_. True) slot s'a))) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte a b xs. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; valid_list s'; (a, b) \<in> descendants_of slot (cdt s'); invs s'; valid_sched s'; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'; cdt s' (a, b) = Some slot; cdt_list s' slot = (a, b) # xs\<rbrakk> \<Longrightarrow> \<exists>cap. (cap, s') \<in> fst (get_cap (a, b) s')
 2. \<And>cap cte nextCTE a x y capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; (x, s') \<in> fst (get s'); (y, s') \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s'); (capa, s') \<in> fst (get_cap (the (next_child slot (cdt_list x))) s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'a. (capa, s) \<in> fst (get_cap (the (next_child slot (cdt_list x))) s'a) \<and> (\<exists>s'b. (y, s'a) \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s'b) \<and> (\<exists>s'a. (x, s'b) \<in> fst (get s'a) \<and> cdt s' = cdt s'a \<and> cte_wp_at ((=) cap) slot s'a \<and> invs s'a \<and> valid_list s'a \<and> valid_sched s'a \<and> simple_sched_action s'a \<and> cte_wp_at (\<lambda>_. True) slot s'a))) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte a b xs. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; valid_list s'; (a, b) \<in> descendants_of slot (cdt s'); invs s'; valid_sched s'; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'; cdt_list s' slot = (a, b) # xs; (a, b) \<in> descendants_of slot (cdt s')\<rbrakk> \<Longrightarrow> \<exists>cap. (cap, s') \<in> fst (get_cap (a, b) s')
 2. \<And>cap cte nextCTE a x y capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; (x, s') \<in> fst (get s'); (y, s') \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s'); (capa, s') \<in> fst (get_cap (the (next_child slot (cdt_list x))) s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'a. (capa, s) \<in> fst (get_cap (the (next_child slot (cdt_list x))) s'a) \<and> (\<exists>s'b. (y, s'a) \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s'b) \<and> (\<exists>s'a. (x, s'b) \<in> fst (get s'a) \<and> cdt s' = cdt s'a \<and> cte_wp_at ((=) cap) slot s'a \<and> invs s'a \<and> valid_list s'a \<and> valid_sched s'a \<and> simple_sched_action s'a \<and> cte_wp_at (\<lambda>_. True) slot s'a))) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte a b xs. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; valid_list s'; invs s'; valid_sched s'; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'; cdt_list s' slot = (a, b) # xs; (a, b) \<in> descendants_of slot (cdt s'); cte_wp_at (\<lambda>_. True) (a, b) s'\<rbrakk> \<Longrightarrow> \<exists>cap. (cap, s') \<in> fst (get_cap (a, b) s')
 2. \<And>cap cte nextCTE a x y capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; (x, s') \<in> fst (get s'); (y, s') \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s'); (capa, s') \<in> fst (get_cap (the (next_child slot (cdt_list x))) s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'a. (capa, s) \<in> fst (get_cap (the (next_child slot (cdt_list x))) s'a) \<and> (\<exists>s'b. (y, s'a) \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s'b) \<and> (\<exists>s'a. (x, s'b) \<in> fst (get s'a) \<and> cdt s' = cdt s'a \<and> cte_wp_at ((=) cap) slot s'a \<and> invs s'a \<and> valid_list s'a \<and> valid_sched s'a \<and> simple_sched_action s'a \<and> cte_wp_at (\<lambda>_. True) slot s'a))) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte nextCTE a x y capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; (x, s') \<in> fst (get s'); (y, s') \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s'); (capa, s') \<in> fst (get_cap (the (next_child slot (cdt_list x))) s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. \<exists>s'a. (capa, s) \<in> fst (get_cap (the (next_child slot (cdt_list x))) s'a) \<and> (\<exists>s'b. (y, s'a) \<in> fst (assert (the (next_child slot (cdt_list x)) \<in> descendants_of slot (cdt s')) s'b) \<and> (\<exists>s'a. (x, s'b) \<in> fst (get s'a) \<and> cdt s' = cdt s'a \<and> cte_wp_at ((=) cap) slot s'a \<and> invs s'a \<and> valid_list s'a \<and> valid_sched s'a \<and> simple_sched_action s'a \<and> cte_wp_at (\<lambda>_. True) slot s'a))) (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete (the (next_child slot (cdt_list x)));
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s')\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa = cap.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 2. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte nextCTE a x capa s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa = cap.NullCap; (capa, s') \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s'; cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s'a \<and> cte_wp_at' ((=) cte) (cte_map slot) s'a \<and> invs' s'a \<and> sch_act_simple s'a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; (s', s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> False
 2. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa = cap.NullCap; False\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 3. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte nextCTE a b s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (a, b); valid_list s'; (a, b) \<in> descendants_of slot (cdt s'); (cap.NullCap, s') \<in> fst (get_cap (a, b) s'); (s', s'a) \<in> state_relation; invs s'; cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s'a; valid_sched s'; cte_wp_at' ((=) cte) (cte_map slot) s'a; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'; invs' s'a; sch_act_simple s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a\<rbrakk> \<Longrightarrow> False
 2. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa = cap.NullCap; False\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 3. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte nextCTE a b s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; valid_list s'; (a, b) \<in> descendants_of slot (cdt s'); (cap.NullCap, s') \<in> fst (get_cap (a, b) s'); (s', s'a) \<in> state_relation; invs s'; cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s'a; valid_sched s'; cte_wp_at' ((=) cte) (cte_map slot) s'a; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'; invs' s'a; sch_act_simple s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; (\<exists>xs. cdt_list s' slot = (a, b) # xs) \<and> cdt s' (a, b) = Some slot\<rbrakk> \<Longrightarrow> False
 2. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa = cap.NullCap; False\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 3. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte nextCTE a b s'a xs. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; valid_list s'; (a, b) \<in> descendants_of slot (cdt s'); (cap.NullCap, s') \<in> fst (get_cap (a, b) s'); (s', s'a) \<in> state_relation; invs s'; cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s'a; valid_sched s'; cte_wp_at' ((=) cte) (cte_map slot) s'a; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'; invs' s'a; sch_act_simple s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; cdt s' (a, b) = Some slot; cdt_list s' slot = (a, b) # xs\<rbrakk> \<Longrightarrow> False
 2. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa = cap.NullCap; False\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 3. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte nextCTE a b s'a xs. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; valid_list s'; (a, b) \<in> descendants_of slot (cdt s'); (cap.NullCap, s') \<in> fst (get_cap (a, b) s'); (s', s'a) \<in> state_relation; invs s'; cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s'a; valid_sched s'; cte_wp_at' ((=) cte) (cte_map slot) s'a; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'; invs' s'a; sch_act_simple s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; cdt_list s' slot = (a, b) # xs; (a, b) \<in> descendants_of slot (cdt s')\<rbrakk> \<Longrightarrow> False
 2. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa = cap.NullCap; False\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 3. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (4 subgoals):
 1. \<And>cap cte nextCTE a b s'a xs. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; valid_list s'; (cap.NullCap, s') \<in> fst (get_cap (a, b) s'); (s', s'a) \<in> state_relation; invs s'; cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s'a; valid_sched s'; cte_wp_at' ((=) cte) (cte_map slot) s'a; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'; invs' s'a; sch_act_simple s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; cdt_list s' slot = (a, b) # xs; (a, b) \<in> descendants_of slot (cdt s')\<rbrakk> \<Longrightarrow> valid_mdb s'
 2. \<And>cap cte nextCTE a b s'a xs. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; valid_list s'; (cap.NullCap, s') \<in> fst (get_cap (a, b) s'); (s', s'a) \<in> state_relation; invs s'; cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s'a; valid_sched s'; cte_wp_at' ((=) cte) (cte_map slot) s'a; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'; invs' s'a; sch_act_simple s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; cdt_list s' slot = (a, b) # xs; (a, b) \<in> descendants_of slot (cdt s'); cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s'\<rbrakk> \<Longrightarrow> False
 3. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa = cap.NullCap; False\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 4. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte nextCTE a b s'a xs. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; valid_list s'; (cap.NullCap, s') \<in> fst (get_cap (a, b) s'); (s', s'a) \<in> state_relation; invs s'; cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s'a; valid_sched s'; cte_wp_at' ((=) cte) (cte_map slot) s'a; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'; invs' s'a; sch_act_simple s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; cdt_list s' slot = (a, b) # xs; (a, b) \<in> descendants_of slot (cdt s'); cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s'\<rbrakk> \<Longrightarrow> False
 2. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa = cap.NullCap; False\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 3. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa = cap.NullCap; False\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE))
 2. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- assertE (capa \<noteq> cap.NullCap);
y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte nextCTE a x capa s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa \<noteq> cap.NullCap; (capa, s') \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s'; cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s'a \<and> cte_wp_at' ((=) cte) (cte_map slot) s'a \<and> invs' s'a \<and> sch_act_simple s'a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; (s', s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> isMDBParentOf cte nextCTE
 2. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte nextCTE a b capa s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (a, b); valid_list s'; (a, b) \<in> descendants_of slot (cdt s'); capa \<noteq> cap.NullCap; (s', s'a) \<in> state_relation; (capa, s') \<in> fst (get_cap (a, b) s'); cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s'a; invs s'; cte_wp_at' ((=) cte) (cte_map slot) s'a; valid_sched s'; invs' s'a; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'; sch_act_simple s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a\<rbrakk> \<Longrightarrow> isMDBParentOf cte nextCTE
 2. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte nextCTE a b capa s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; cte_wp_at' (isMDBParentOf cte) (mdbNext (cteMDBNode cte)) s'a; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (a, b); valid_list s'; (a, b) \<in> descendants_of slot (cdt s'); capa \<noteq> cap.NullCap; (s', s'a) \<in> state_relation; cte_wp_at ((=) capa) (a, b) s'; cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s'a; invs s'; cte_wp_at' ((=) cte) (cte_map slot) s'a; valid_sched s'; invs' s'a; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'; sch_act_simple s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; descendants_of slot (cdt s') \<noteq> {}\<rbrakk> \<Longrightarrow> isMDBParentOf cte nextCTE
 2. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte nextCTE a x capa s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; (capa, s') \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s'; cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s'a \<and> cte_wp_at' ((=) cte) (cte_map slot) s'a \<and> invs' s'a \<and> sch_act_simple s'a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a; (s', s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> ?F364 cap cte nextCTE a x capa
 2. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; ?F364 cap cte nextCTE a x capa\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>cap cte nextCTE a b capa s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (a, b); valid_list s'; (a, b) \<in> descendants_of slot (cdt s'); capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; (s', s'a) \<in> state_relation; (capa, s') \<in> fst (get_cap (a, b) s'); cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s'a; invs s'; cte_wp_at' ((=) cte) (cte_map slot) s'a; valid_sched s'; invs' s'a; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'; sch_act_simple s'a; cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a\<rbrakk> \<Longrightarrow> ?F364 cap cte nextCTE (a, b) s' capa
 2. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); (capa, s') \<in> fst (get_cap a s'); capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; ?F364 cap cte nextCTE a x capa\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. (capa, s) \<in> fst (get_cap a s') \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE (isMDBParentOf cte nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte nextCTE a x capa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; mdbNext (cteMDBNode cte) \<noteq> nullPointer; next_child slot (cdt_list s') = Some a; valid_list s'; x = s'; a \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) a s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; \<exists>aa b. mdbNext (cteMDBNode cte) = cte_map (aa, b) \<and> a = (aa, b)\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. s' = s \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (mdbNext (cteMDBNode cte)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- cap_delete a;
y <- preemption_point;
cap_revoke slot
odE) (whenE True (doE y <- cteDelete (mdbNext (cteMDBNode cte)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)) proof (prove)
goal (1 subgoal):
 1. \<And>cap cte nextCTE capa aa ba. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba)\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (\<lambda>s. s' = s \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s') (\<lambda>s. cte_wp_at' ((=) nextCTE) (cte_map (aa, ba)) s \<and> cte_wp_at' ((=) cte) (cte_map slot) s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) (doE y <- cap_delete (aa, ba);
y <- preemption_point;
cap_revoke slot
odE) (doE y <- cteDelete (cte_map (aa, ba)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE) proof (prove)
goal (3 subgoals):
 1. \<And>cap cte nextCTE capa aa ba. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba)\<rbrakk> \<Longrightarrow> spec_corres s' (dc \<oplus> dc) (?Q413 cap cte nextCTE capa aa ba) (?Q'413 cap cte nextCTE capa aa ba) (doE y <- cap_delete (aa, ba);
y <- preemption_point;
cap_revoke slot
odE) (doE y <- cteDelete (cte_map (aa, ba)) True;
y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
 2. \<And>cap cte nextCTE capa aa ba. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); s' = s' \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s'\<rbrakk> \<Longrightarrow> ?Q413 cap cte nextCTE capa aa ba s'
 3. \<And>cap cte nextCTE capa aa ba s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); cte_wp_at' ((=) nextCTE) (cte_map (aa, ba)) s'a \<and> cte_wp_at' ((=) cte) (cte_map slot) s'a \<and> invs' s'a \<and> sch_act_simple s'a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a\<rbrakk> \<Longrightarrow> ?Q'413 cap cte nextCTE capa aa ba s'a proof (prove)
goal (5 subgoals):
 1. \<And>cap cte nextCTE capa aa ba rv rv' s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); (Inr rv, s'a) \<in> fst (cap_delete (aa, ba) s'); dc rv rv'\<rbrakk> \<Longrightarrow> spec_corres s'a (dc \<oplus> dc) (?R417 cap cte nextCTE capa aa ba rv) (?R'417 cap cte nextCTE capa aa ba rv') (doE y <- preemption_point;
cap_revoke slot
odE) (doE y <- preemptionPoint;
cteRevoke (cte_map slot)
odE)
 2. \<And>cap cte nextCTE capa aa ba. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba)\<rbrakk> \<Longrightarrow> \<lbrace>?Q417 cap cte nextCTE capa aa ba\<rbrace> cap_delete (aa, ba) \<lbrace>?R417 cap cte nextCTE capa aa ba\<rbrace>, -
 3. \<And>cap cte nextCTE capa aa ba. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'417 cap cte nextCTE capa aa ba\<rbrace> cteDelete (cte_map (aa, ba)) True \<lbrace>?R'417 cap cte nextCTE capa aa ba\<rbrace>, -
 4. \<And>cap cte nextCTE capa aa ba. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); s' = s' \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s'\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (aa, ba) and emptyable (aa, ba) and ?Q417 cap cte nextCTE capa aa ba) s'
 5. \<And>cap cte nextCTE capa aa ba s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); cte_wp_at' ((=) nextCTE) (cte_map (aa, ba)) s'a \<and> cte_wp_at' ((=) cte) (cte_map slot) s'a \<and> invs' s'a \<and> sch_act_simple s'a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and ?Q'417 cap cte nextCTE capa aa ba) s'a proof (prove)
goal (7 subgoals):
 1. \<And>cap cte nextCTE capa aa ba rv rv' s'a rva rv'a s'aa. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); (Inr rv, s'a) \<in> fst (cap_delete (aa, ba) s'); dc rv rv'; (Inr rva, s'aa) \<in> fst (preemption_point s'a); dc rva rv'a\<rbrakk> \<Longrightarrow> spec_corres s'aa (dc \<oplus> dc) (?R422 cap cte nextCTE capa aa ba rv rv' s'a rva) (?R'422 cap cte nextCTE capa aa ba rv rv' s'a rv'a) (cap_revoke slot) (cteRevoke (cte_map slot))
 2. \<And>cap cte nextCTE capa aa ba rv rv' s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); (Inr rv, s'a) \<in> fst (cap_delete (aa, ba) s'); dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q423 cap cte nextCTE capa aa ba rv\<rbrace> preemption_point \<lbrace>?R422 cap cte nextCTE capa aa ba rv rv' s'a\<rbrace>, -
 3. \<And>cap cte nextCTE capa aa ba rv rv' s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); (Inr rv, s'a) \<in> fst (cap_delete (aa, ba) s'); dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'424 cap cte nextCTE capa aa ba rv'\<rbrace> preemptionPoint \<lbrace>?R'422 cap cte nextCTE capa aa ba rv rv' s'a\<rbrace>, -
 4. \<And>cap cte nextCTE capa aa ba. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba)\<rbrakk> \<Longrightarrow> \<lbrace>?Q417 cap cte nextCTE capa aa ba\<rbrace> cap_delete (aa, ba) \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q423 cap cte nextCTE capa aa ba rv\<rbrace>, -
 5. \<And>cap cte nextCTE capa aa ba. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'417 cap cte nextCTE capa aa ba\<rbrace> cteDelete (cte_map (aa, ba)) True \<lbrace>\<lambda>rv'. (\<lambda>_. True) and ?Q'424 cap cte nextCTE capa aa ba rv'\<rbrace>, -
 6. \<And>cap cte nextCTE capa aa ba. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); s' = s' \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s'\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (aa, ba) and emptyable (aa, ba) and ?Q417 cap cte nextCTE capa aa ba) s'
 7. \<And>cap cte nextCTE capa aa ba s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); cte_wp_at' ((=) nextCTE) (cte_map (aa, ba)) s'a \<and> cte_wp_at' ((=) cte) (cte_map slot) s'a \<and> invs' s'a \<and> sch_act_simple s'a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and ?Q'417 cap cte nextCTE capa aa ba) s'a proof (prove)
goal (6 subgoals):
 1. \<And>cap cte nextCTE capa aa ba rv rv' s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); (Inr rv, s'a) \<in> fst (cap_delete (aa, ba) s'); dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q423 cap cte nextCTE capa aa ba rv\<rbrace> preemption_point \<lbrace>\<lambda>rva. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot\<rbrace>, -
 2. \<And>cap cte nextCTE capa aa ba rv rv' s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); (Inr rv, s'a) \<in> fst (cap_delete (aa, ba) s'); dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'424 cap cte nextCTE capa aa ba rv'\<rbrace> preemptionPoint \<lbrace>\<lambda>rv'a. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)\<rbrace>, -
 3. \<And>cap cte nextCTE capa aa ba. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba)\<rbrakk> \<Longrightarrow> \<lbrace>?Q417 cap cte nextCTE capa aa ba\<rbrace> cap_delete (aa, ba) \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q423 cap cte nextCTE capa aa ba rv\<rbrace>, -
 4. \<And>cap cte nextCTE capa aa ba. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'417 cap cte nextCTE capa aa ba\<rbrace> cteDelete (cte_map (aa, ba)) True \<lbrace>\<lambda>rv'. (\<lambda>_. True) and ?Q'424 cap cte nextCTE capa aa ba rv'\<rbrace>, -
 5. \<And>cap cte nextCTE capa aa ba. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); s' = s' \<and> invs s' \<and> valid_sched s' \<and> simple_sched_action s' \<and> cte_wp_at (\<lambda>_. True) slot s'\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (aa, ba) and emptyable (aa, ba) and ?Q417 cap cte nextCTE capa aa ba) s'
 6. \<And>cap cte nextCTE capa aa ba s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); cte_wp_at' ((=) nextCTE) (cte_map (aa, ba)) s'a \<and> cte_wp_at' ((=) cte) (cte_map slot) s'a \<and> invs' s'a \<and> sch_act_simple s'a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and ?Q'417 cap cte nextCTE capa aa ba) s'a proof (prove)
goal (2 subgoals):
 1. \<And>cap cte nextCTE capa aa ba. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); invs s'; valid_sched s'; simple_sched_action s'; cte_wp_at (\<lambda>_. True) slot s'\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, ba) s' \<and> emptyable (aa, ba) s'
 2. \<And>cap cte nextCTE capa aa ba s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); cte_wp_at' ((=) nextCTE) (cte_map (aa, ba)) s'a \<and> cte_wp_at' ((=) cte) (cte_map slot) s'a \<and> invs' s'a \<and> sch_act_simple s'a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and (\<lambda>s. True \<and> (invs' and sch_act_simple and K True) s \<and> (invs' and sch_act_simple and (\<lambda>s. \<not> True \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)) s)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) s'a proof (prove)
goal (2 subgoals):
 1. \<And>cap cte nextCTE capa aa ba. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); invs s'; valid_sched s'; simple_sched_action s'\<rbrakk> \<Longrightarrow> emptyable (aa, ba) s'
 2. \<And>cap cte nextCTE capa aa ba s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); cte_wp_at' ((=) nextCTE) (cte_map (aa, ba)) s'a \<and> cte_wp_at' ((=) cte) (cte_map slot) s'a \<and> invs' s'a \<and> sch_act_simple s'a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and (\<lambda>s. True \<and> (invs' and sch_act_simple and K True) s \<and> (invs' and sch_act_simple and (\<lambda>s. \<not> True \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)) s)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) s'a proof (prove)
goal (2 subgoals):
 1. \<And>cap cte nextCTE capa aa ba. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); invs s'; valid_sched s'; simple_sched_action s'; (\<exists>xs. cdt_list s' slot = (aa, ba) # xs) \<and> cdt s' (aa, ba) = Some slot\<rbrakk> \<Longrightarrow> emptyable (aa, ba) s'
 2. \<And>cap cte nextCTE capa aa ba s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); cte_wp_at' ((=) nextCTE) (cte_map (aa, ba)) s'a \<and> cte_wp_at' ((=) cte) (cte_map slot) s'a \<and> invs' s'a \<and> sch_act_simple s'a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and (\<lambda>s. True \<and> (invs' and sch_act_simple and K True) s \<and> (invs' and sch_act_simple and (\<lambda>s. \<not> True \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)) s)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) s'a proof (prove)
goal (2 subgoals):
 1. \<And>cap cte nextCTE capa aa ba xs. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); invs s'; valid_sched s'; simple_sched_action s'; cdt_list s' slot = (aa, ba) # xs; (aa, ba) \<in> descendants_of slot (cdt s')\<rbrakk> \<Longrightarrow> emptyable (aa, ba) s'
 2. \<And>cap cte nextCTE capa aa ba s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); cte_wp_at' ((=) nextCTE) (cte_map (aa, ba)) s'a \<and> cte_wp_at' ((=) cte) (cte_map slot) s'a \<and> invs' s'a \<and> sch_act_simple s'a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and (\<lambda>s. True \<and> (invs' and sch_act_simple and K True) s \<and> (invs' and sch_act_simple and (\<lambda>s. \<not> True \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)) s)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) s'a proof (prove)
goal (1 subgoal):
 1. \<And>cap cte nextCTE capa aa ba s'a. \<lbrakk>cte_wp_at ((=) cap) slot s'; cap_relation cap (cteCap cte); cap \<noteq> cap.NullCap; cteCap cte \<noteq> capability.NullCap; descendants_of slot (cdt s') \<noteq> {}; cte_map (aa, ba) \<noteq> nullPointer; next_child slot (cdt_list s') = Some (aa, ba); valid_list s'; (aa, ba) \<in> descendants_of slot (cdt s'); cte_wp_at ((=) capa) (aa, ba) s'; capa \<noteq> cap.NullCap; isMDBParentOf cte nextCTE; mdbNext (cteMDBNode cte) = cte_map (aa, ba); cte_wp_at' ((=) nextCTE) (cte_map (aa, ba)) s'a \<and> cte_wp_at' ((=) cte) (cte_map slot) s'a \<and> invs' s'a \<and> sch_act_simple s'a \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s'a\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and (\<lambda>s. True \<and> (invs' and sch_act_simple and K True) s \<and> (invs' and sch_act_simple and (\<lambda>s. \<not> True \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (aa, ba)) s)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) s'a proof (prove)
goal:
No subgoals! proof (state)
this:
spec_corres s' (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) slot) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (cap_revoke slot) (cteRevoke (cte_map slot))

goal:
No subgoals!